Here's the scoop on the Windows animated cursor bug

Microsoft is promising an early patch for the ANI vulnerability

When a major vulnerability affecting every flavor of Windows -- including Vista -- breaks, it only seems like chaos ensues. Okay, so it is chaos. Witness the so-far short-lived flaw in Windows' animated cursors (ANI), which picked up enough steam over the weekend to power a turbine or two. IT staff, small business users and consumers have been trying to figure out which way is up, and whether this is a Big Deal or just another security industry siren blaring in the background. This FAQ on the flaw, explains what it is, which machines are at risk and what you can do to protect yourself.

What's the problem, anyway? A critical flaw in User32.dll, specifically in the code of that Windows .dll that loads animated cursor (.ani) files, which are used to trick out the cursor, changing it from a simple pointer to a short animation. Microsoft, for example, sometimes includes animated cursors in its optional visual theme downloads. Exploits targeting the bug can use ANI files to run malicious code on a victimized PC, infecting it with spyware, stealing identity information or adding it to a botnet of hijacked systems.

When did this pop up? Microsoft says it was first notified in late December 2006 by researchers at Determina, but others -- including Marc Maiffret of eEye Digital Security -- point out that the vulnerability is very similar to one patched in January 2005 that also affected cursor files. It wasn't until last week -- March 28, to be exact -- that attacks using the exploit were spotted in the wild (by McAfee) and reported to Microsoft's Security Response Center (MSRC).

What versions of Windows are vulnerable? This is the cropper, isn't it? One of the things that makes the ANI bug so dangerous is that it affects every still-supported edition of Windows, including Windows 2000 SP4, XP SP2, Server 2003 (up to SP2), and even Vista. Both 32- and 64-bit versions are at risk.

What about Linux or Mac systems? Are they at risk, too? Hahahahahaha. Sorry. Nope.

Are hackers using the vulnerability? Funny. China's Internet Security Response Team (CISRT) warned over the weekend that a worm exploiting ANI was in the wild. Symantec tagged the worm as Fubalca, while other security companies -- no surprise here -- applied different monikers. McAfee, for instance, calls it Fujacks.aa, while Computer Associates labeled it MSA-935423!exploit. Nothing like consistency. Other reports have cited one or more spam runs that include links to malicious sites hosting an ANI exploit, while the newest information from Websense Inc. is that there are at minimum 150 Web sites circulating the attack. So the short answer, unfortunately, is yes.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?