Microsoft zero day attack more widespread than thought, with no Patch Tuesday fix coming

Well, this isn’t good news. A malicious “zero day” attack capable of hijacking your PC via a vulnerability found in Windows, Office, and Lync is being exploited more widely than originally thought, and Microsoft won’t have a permanent fix ready in time for next week’s Patch Tuesday blitz.

The vulnerability uses custom TIFF images to allow the attacker to remotely execute code on your machine, at the same user rights level as the victim. In other words, if your account is infected but isn’t an administrator account, the attacker won’t get administrator-level access—but if an infected account is an admistrator, the hacker will have the full run of your machine.

Image: Fire Eye

(Click to enlarge.)

Microsoft originally said it knew of “targeted attacks that attempt to exploit this vulnerability,” but new reports by the security researchers at Fire Eye and Symantec claim that malware groups are actively using the TIFF flaw to hack into computers, as first reported by Ars Technica. At least one of those gangs is using the exploit to plant the devastating Citadel banking Trojan on infiltrated PCs, via emails such as the one at right.

The following Microsoft software is vulnerable to the exploit:

To read this article in full or to leave a comment, please click here

Source: http://www.pcworld.com/article/2061257/microsoft-zero-day-attack-more-widespread-than-thought-with-no-patch-tuesday-fix-coming.html#tk.rss_all

NOVELL NETWORK APPLIANCE NETGEAR NCR NATIONAL SEMICONDUCTOR NATIONAL INSTRUMENTS MOTOROLA