Unpatched Windows Zero-Day Vulnerability Confirmed

Microsoft has issued the following advisory warning of an unpatched zero-day exploit that was first discovered in mid-December.

The company issued the advisory after a Metasploit tool was released an exploit module and warned that hackers can use the flaw in Window's graphics rendering engine to control a targeted PC, harvest information, and add them to a botnet.

Windows XP, Vista, Server 2003 and Server 2008 are vulnerable to the exploit, where a malformed thumbnail contained in a document could cause the targeted PC to be infected if the document was opened or even previewed.

Microsoft Security Advisory (2490606)

Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution

Microsoft is investigating new public reports of a vulnerability in the Windows Graphics Rendering Engine. An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the logged-on user. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

We are not aware of attacks that try to use the reported vulnerability or of customer impact at this time.

We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers.

Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.

Issue References

For more information about this issue, see the following references:

CVE Reference

CVE-2010-3970

Microsoft Knowledge Base Article 

2490606

**Server Core installation not affected. The vulnerabilities discussed in this advisory do not affect supported editions of Windows Server 2008 as indicated, when installed using the Server Core installation option.    For more information on this installation option, see the TechNet articles, Managing a Server Core Installation and Servicing a Server Core Installation. Note that the Server Core installation option does not apply to certain editions of Windows Server 2008; see Compare Server Core Installation Options.

Source:  http://www.microsoft.com/technet/security/advisory/2490606.mspx