Zero-day Microsoft flaw already being exploited

The Microsoft flaw affects Windows XP and Windows Server 2003

Security experts have warned that hackers are already exploiting a zero-day vulnerability in Windows Help and Support Center, just days after a Google researcher published exploit code for the attack.

Tavis Ormandy went public with the CVE 2010-1885 vulnerability last week, having given Microsoft just five days to develop a fix. The flaw affects Windows XP and Windows Server 2003.

However, security vendor Sophos warned in a blog post yesterday that a compromised web site has been discovered that exploits the vulnerability by installing Trojan malware which could result in arbitrary code execution on a victim's machine.

Sophos senior technology consultant Graham Cluley launched a scathing attack on Ormandy, arguing that he should have worked with Microsoft to fix the problem and disclosed the vulnerability only when a patch was available.

"Do you feel proud of your behaviour? Do you think that you have helped raise security on the internet? Or did you put your vanity ahead of others' safety?" he wrote in a blog post.

"Five days isn't a sensible period of time to expect Microsoft to develop a fix which has to be tested thoroughly to ensure it doesn't cause more problems than it intends to correct."