News

Hackers Exploiting Windows XP Help Flaw

Microsoft today revised its security advisory on a Windows help function flaw, noting that the proof-of-concept code to exploit the flaw is now being used by hackers.

The flaw, described last week, just affects Windows XP systems. Microsoft ruled out earlier concerns that Windows Server 2003 might have been vulnerable, according to security advisory 2219475 revised on June 15, 2010.

"Microsoft is aware that proof-of-concept exploit code has been published for the vulnerability," the revised advisory now states. "Microsoft is also aware of limited, targeted active attacks that use this exploit code. Based on the samples analyzed, Windows Server 2003 systems are not currently at risk from these attacks."

The active attacks were also confirmed on Tuesday by software security firm Sophos. In a blog post, Sophos identified the malware as "Sus/HcpExpl-A," which is spreading through a compromised Web site. The malware will drop a Trojan (called "Troj/Drop-FS") on a user's computer.

Microsoft has published a Fix it solution that provides an automated workaround for the vulnerability. Otherwise, IT pros would need to unregister the HCP Protocol by editing the Windows Registry to ensure against possible attacks to Windows XP systems. The exploit requires the victim to click on a link in an e-mail or visit a specially crafted malicious Web page.

Microsoft is saying that it will provide any further details at its Microsoft Security Response Center blog or via its Twitter page. Possibly, the company could issue an out-of-band patch or wait to issue a fix with the next security update cycle in July. Microsoft hasn't rated the threat level of the flaw, but Sophos described it as "high."

Meanwhile, the security researcher who first disclosed details about the flaw, Tavis Ormandy, who works for Google, received additional criticism. Graham Cluley, a senior technology consultant at Sophos, chimed in that the five days notice given by Ormandy was insufficient for Microsoft to respond to a zero-day threat.

Ormandy responded to his critics on Twitter by stating that "those five days were spent trying to negotiate a fix within 60 days."

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

  • Hands-On AI Skills Now Outshine Certs in Salary Stakes

    For AI-related roles, employers are prioritizing verifiable, hands-on abilities over framed certificates -- and they're paying a premium for it.

  • Roadblocks in Enterprise AI: Data and Skills Shortfalls Could Cost Millions

    Businesses risk losing up to $87 million a year if they fail to catch up with AI innovation, according to the Couchbase FY 2026 CIO AI Survey released this month.

  • Microsoft Cuts Windows 11 Recovery Time with New Update

    Microsoft has introduced two key enhancements to Windows 11 aimed at minimizing downtime and streamlining error resolution.

  • Microsoft Offers Support Extensions for Exchange 2016 and 2019

    Microsoft has introduced a paid Extended Security Update (ESU) program for on-premises Exchange Server 2016 and 2019, offering a crucial safety cushion as both versions near their Oct. 14, 2025 end-of-support date.