Microsoft trying to fix security hole
Microsoft Corp. is attempting to plug a glaring hole in some versions of its Windows software, a weakness similar to those exploited by the devastating "Blaster" and "Sasser" attacks, a security expert said Tuesday.
The patch, included in the company's monthly security bulletin, fixes a hole that could allow hackers to take complete control of computer systems, Microsoft said.
The problem is most serious on Windows 2000 systems, which could be accessed remotely through the operating system's "Plug and Play" hardware detection feature. Windows Server 2003 and Windows XP systems with major security updates are less vulnerable, but still could be affected by certain remote users or those within local systems, the company said.
Marc Maiffret, chief hacking officer for eEye Digital Security, said the hole resembled weaknesses that allowed the "Blaster" and "Sasser" worms to infect hundreds of thousands of computers worldwide.
"This is the type of vulnerability that's been exploited many times, and those two worms are the biggest examples because they had the biggest impact," Maiffret said.
