0day攻击代码仍在高速传播，Windows光标漏洞仍无补丁

　　CNet消息：Sans Institute首席研究官员约翰尼斯表示，Windows动画光标中的漏洞已经由针对性攻击发展成大规模攻击。

　　据Sans Institute发布的一份安全公告称，黑客在上周四还发布了一种特洛伊木马垃圾邮件，诱惑用户将它认为是IE 7β版。

　　约翰尼斯称，特洛伊木马使用了与合法的微软IE 7β版相同的名字，加大了探测的难度。约翰尼斯说，反病毒软件在对付这一病毒方面无能为力，它在迅速地发送垃圾邮件，可能使用了现有的垃圾邮件网络。

　　他表示，但是，用户只有在点击链接后才会受到感染，因此，与Windows动画光标零日缺陷，或被公开披露但尚未修正的安全缺陷相比，危险性要低一些。

　　据介绍，使用动画光标，用户无需点击链接，只需打开一封恶意电子邮件或访问一个恶意网站就会受到攻击。

　　约翰尼斯指出，在过去的一天中，有数十家网站受到了攻击，微软还没有发布补丁软件。

Vista之家（www.vista123.com）参照英文原文如下：

Attackers exploit zero-day Windows flaw

By Dawn Kawamoto, CNET News.com | 2007/04/02 06:46:02

A zero-day exploit that takes advantage of a vulnerability in the Windows cursor could be spreading rapidly.

The hole in the Windows animated cursor, which was flagged in a Microsoft advisory last week, has moved from a targeted attack to one that is widespread, said Johannes Ullrich, chief research officer for the Sans Institute, which also issued an advisory.

Attackers also on Thursday launched a Trojan spam that dupes users into thinking it's an Internet Explorer 7 beta, according to a Sans advisory. The Trojan uses the same file name as Microsoft's legitimate IE 7 betas, making detection more difficult, Ullrich noted.

"Antivirus software was initially pretty useless in combating it," Ullrich said. "It was spammed out quickly and probably used an existing spam network."

He said, however, that users have to click on a link to have their systems affected, so it is less of a threat than the Windows animated cursor zero-day flaw, or a security hole that has been publicly disclosed but not fixed.

"With the (animated cursor), you don't have to click on a link to get it to launch," Ullrich said. "You just have to open a malicious e-mail or go to a malicious Web site."

Several dozen Web sites have become infected with the exploit in the past day, and Microsoft has yet to issue a patch, he added.

1、Norton 2008 杀毒软件下载
2、金山毒霸 2008 下载
3、Norton 360 全方位防护软件下载
4、Anti-Spam反垃圾软件下载