Security experts say the latest Windows vulnerability revealed last week by Microsoft Corp. has already been used by crackers to attack at least one machine belonging to the U.S. Army. And, it turns out, the flaw used to attack the Web server was discovered not by Microsoft or independent researchers but by the attacker himself. Microsoft released a patch for the critical vulnerability in a Windows 2000 component used by the WebDAV (Web-based Distributed Authoring and Versioning) protocol. The vulnerability gives an attacker control of a vulnerable machine, officials at the Redmond, Wash., company said.

Experts at TruSecure Corp., based in Herndon, Va., received word of the attack on the Army's Web server two weeks ago through contacts within the Army. A Web server was attacked using a URL that was 4KB in length, and the machine was subsequently compromised. The server then immediately began mapping the network around it, looking for other vulnerable machines and seeing what else of interest was within reach. It then started sending the results of its mapping to a remote machine through TCP port 3389 using terminal services, said Russ Cooper, surgeon general at TruSecure.