Second Zero-Day Hole Sinks Windows
A serious security flaw in Visual Studio 2005 disclosed by Microsoft last week is already being attacked, the software giant has admitted.
The incident represents the latest black eye for Microsoft over security, and is part of an increasingly common trend - attackers taking advantage of an unpatched or "zero-day" flaw well before a fix is available. Just last week, Microsoft acknowledged attacks exploiting a newly discovered, different, unpatched bug in the XMLHTTP 4.0 ActiveX control.
That bug is expected to be patched this month, but the Visual Studio flaw is likely to have to wait. In its advisory, Microsoft said it was "are aware of proof of concept code published publicly and of limited attacks using the reported vulnerability", and would take action when its investigation was complete.
