Microsoft announced yesterday that it is to issue a patch for a current Windows flaw tomorrow, a week earlier than planned. The patch will address the security flaw affecting animated cursors that we reported on last Friday.
The vulnerability lies in the way Windows handles .ani files, a format that manages animated cursors and icons. When the file opens, a memory flaw can occur.
A successful attack gives the hacker full control of the computer system. The flaw can be exploited by luring a user to a malicious website, opening a manipulated email message or a virus-infested attachment.
Microsoft posted a warning about the security threat on Thursday last week. It seems to be treating the flaw as critical, deciding that an update couldn't wait another week - until the traditional monthly security update due 10 April - after attacks exploiting the flaw have occurred already.
"Over this weekend attacks against this vulnerability have increased somewhat," programme manager Christopher Budd wrote on Microsoft's Security Response Center blog .
"Additionally, we are aware of public disclosure of proof-of-concept code. In light of these points, and based on customer feedback, we have been working around the clock to test this update and are currently planning to release the security update that addresses this issue on Tuesday."
Microsoft said this was an update, not a complete patch, and that there had been "very limited attacks" caused by the security flaw. It recommended users download the patch immediately.
