Microsoft fixes a security bug

Microsoft hasn't seen anyone take advantage of the bug yet -- the flaw was reported to the company by security researcher Cesar Cerrudo -- but Microsoft thinks that hackers could develop code that reliably exploits the issue. Microsoft has patched a bug in its malware scanning engine that could be used as a stepping stone for an attacker looking to seize control of a Windows box.

The bug is fixed in an update to the Microsoft Malware Protection Engine that was pushed out to users of Microsoft's security products on Wednesday. It's what's known as an elevation of privilege vulnerability -- something that could be used by an attacker who already has access to the Windows system to gain complete administrative control.

In an instant message interview, Cerrudo, the CEO of security research firm Argeniss, said he disclosed the bug publicly at the Black Hat security conference in July 2010. But because the hacker would already need have access to the machine to pull off this attack, he doesn't believe that it presents a major security risk to most user.

Microsoft rates the issue as "important."

The issue is fixed in Version 1.1.6603.0 of the Malware Protection Engine, which is used in Windows Live OneCare, Microsoft Security Essentials, Windows Defender, Forefront Client Security, Forefront Endpoint Protection 2010, and the Microsoft Malicious Software Removal Tool.

Posted in: Technology