Microsoft announced a security flaw on Thursday that could allow malicious hackers to reset the Internet connections of affected computers and networks.
The vulnerability would allow denial-of-service attacks on affected systems, but would not allow programs to run or establish user rights, said the company.
Only those systems running Windows XP and Windows Server 2003 are affected, said Microsoft in a security advisory.
Those users that have installed Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 are not vulnerable to the flaw.
Downplaying the Danger
Microsoft also notes that there are no reports of exploits based on the flaw. Attackers looking to take advantage of the vulnerability would first need to know or guess the IP address and port information of the affected Internet connection.
In addition, many applications that establish Internet connections on behalf of users are programmed to reset the connection automatically if it is lost.
However, this is the type of language commonly employed by software makers when addressing security concerns, said Laura DiDio of Yankee Group.
Many malicious hackers take such statements as challenges. "All they have to do is to visit any one of a number of Internet sites or talk to any one of a number of black-hat hackers to get instructions," she stressed.
Credit for Improvement
Microsoft deserves credit for improving its dealing with security issues, DiDio asserted. "They have gotten a handle on the problem to a degree, there have been improvements in the core code, and they are much more proactive and less defensive," she said.
Much of this improvement has been of necessity, though, she added.
"The attacks are getting more sophisticated and pernicious," DiDio explained. "In addition, more systems are connected, which means that you can circumvent the globe faster than you can say Magellan."
|