Security experts are bracing themselves for a spate of new worms and viruses designed to exploit of the seven new vulnerabilities announced by Microsoft on Tuesday as part of its monthly patch cycle.
Of the new vulnerabilities, Windows Shell (MS04-024) -- has been picked out by security experts as a potential target for future worms and viruses.
Ben Nagy, senior security engineer at security researcher firm eEye, said he expects the Windows Shell bug to be the most serious threat -- despite Microsoft rating the problem as 'important' rather than 'critical'.
According to Microsoft, if a user is vulnerable to MS04-024 and has administrator privileges, an attacker could "take complete control of the affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts with full privileges."
However, the flaw is not rated as critical because it would require "significant user interaction" to work This means that a user would need to open an email attachment, or download a file from a malicious Web site.
Richard Starnes, president of security industry group ISSA UK, said that malware writers usually reverse-engineer Microsoft's patches in order to produce exploits. Based on his on experience of previous threats, he expects the first batch of new exploit codes to be available as early as next week. These would probably be used to create a worm delivered as an email attachment.
"Given the trend, it will probably take between five and seven days for exploits to start appearing -- depending on their complexity. Because it has to be locally executed, it is likely to be another LoveBug scenario," Starnes said.
EEye's Nagy agrees that to exploit the vulnerability, a virus will most likely be distributed as an email attachment, but the vulnerability could also be 'blended' with another attack.
"I don't think either vulnerability could create a Sasser or MSBlast type-worm, but we are seeing many blended threats, so it could be used in combination with other exploits," said Nagy.
ZDNet UK's Munir Kotadia reported from London. For more coverage from ZDNet UK, click here.
Enough is enough, with no relief in sight. I Have been an MS user since MS Dos v4.01. I believe the time has come to move to a more secure OS. I did changed to IBM's OS2, but the available software for the system, at the time, was very limited. So, I rejoined the MS Shuffle from one system release to another. As some learned scribes have intimated, (Becaue of all these securiry flaws) Quote, "Is this the begining of the end for MS". In my opinion, yes. What I have to decide is which of the available alternate OS should I opt for?