An exploit against the Windows Media Player vulnerability disclosed by Microsoft two days ago is nearly finished, a security company said Thursday, and may be only hours away from hitting unpatched users.
The bug, which was made public Tuesday in security bulletin MS06-005, allows attackers armed with malicious .bmp image files to hijack Windows PCs.
"There are two exploits circulating," said Mike Puterbaugh, the vice president of marketing at eEye Digital Security, the Aliso Viejo, Calif.-based company which first uncovered the Media Player vulnerability.
"One is somewhat minor, and can cause a denial-of-service, but the second we're taking far more seriously," said Puterbaugh. "It's 95 percent there as a propagated mass attack.
Users can download Microsoft's patch via Windows Update, Microsoft Update, or direct from the developer's Download Center.
|