Microsoft releases temporary fix for critical Windows bug
Microsoft has issued a temporary fix for a critical Windows vulnerability that has already been exploited to install highly sophisticated malware that targeted manufacturers of industrial systems.
In an advisory issued late Thursday, Microsoft said the previously unknown flaw in the Win32k TrueType font-parsing engine affected every supported version of Windows, including Windows 7 and Windows Server 2008, which are the most secure to date. The critical vulnerability was recently exploited to spread Duqu, malware that some researchers say was derived from last year's Stuxnet worm that sabotaged Iran's uranium enrichment program.
“An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode,” the advisory warned. “The attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.” The accompanying Fix it is designed to protect against exploits until a permanent patch is issued. The company didn't indicate when that would happen, except to say it wouldn't be before next Tuesday's regularly scheduled security update release.
