U.S. Flag Official website of the Department of Homeland Security

Note: This page is part of the us-cert.gov archive.This document is part of the US-CERT website archive. These documents are no longer updated and may contain outdated information. Links may also no longer function. Please contact info@us-cert.gov if you have any questions about the US-CERT website archive.

TLP:WHITE

Alert (SA07-089A)

Microsoft Windows ANI Vulnerability

Original release date: March 30, 2007 | Last revised: April 03, 2007

Systems Affected

Microsoft Windows 2000, XP, Server 2003, and Vista are affected. Affected applications include
  • Microsoft Windows
  • Microsoft Internet Explorer
  • Microsoft Outlook
  • Microsoft Outlook Express
  • Microsoft Windows Mail
  • Microsoft Windows Explorer

Overview

A vulnerability exists in Microsoft Windows that could allow an attacker to gain control of your computer. This vulnerability is being actively exploited.


Solution

Install updates

Microsoft has provided updates to remedy this and other vulnerabilities. To obtain these updates, visit the Microsoft Update web site. We also recommend enabling Automatic Updates.

Workarounds

Until you are able to install updates, the following may reduce the chances of successful exploitation:

  • Do not follow unsolicited or suspicious links—Do not click unsolicited links received in email, instant messages, web forums, or internet relay chat (IRC) channels. Type URLs directly into the browser to avoid these misleading links.

  • Do not open or read untrusted email—Do not open or read email that comes from unknown or untrusted sources.

Description

A vulnerability exists in Microsoft Windows that could allow an attacker to gain control of your computer. This vulnerability occurs when Microsoft Windows processes malicious animated cursor files. An attacker could exploit this vulnerability by convincing you to visit a malicious web site or open a malicious email message.

US-CERT is tracking this issue as VU#191609.


References


.

Revision History

  • March 30, 2007: Initial release
    April 3, 2007: Updated with release of MS07-017. Title changed, previous title was "Microsoft Windows ANI Vulnerability."

This product is provided subject to this Notification and this Privacy & Use policy.

Was this document helpful?  Yes  |  Somewhat  |  No

Back to Top