Monday, 8 August 2005

Critical Unpatched Hole Found in Windows 2000

A fresh unpatched security flaw has surfaced in Windows 2000, impacting the many end-users and companies still dependent on the operating system. The flaw affects a core component of Windows 2000 that can't be disabled, meaning a workaround is unlikely, according to security firm eEye, which discovered the bug. The company said it won't release details of how the flaw works, until Microsoft has issued a patch. However, it said the vulnerability isn't limited to Windows 2000 alone - Internet Explorer, Windows Server 2003, Windows XP and XP SP1 are all vulnerable, its advisory states. EEye gave the bug a "high risk" rating, and said it could be easily exploited, by a worm for example, to take over systems remotely. Microsoft said it is investigating the bug and may issue a fix. However, Microsoft is winding down support for Windows 2000, despite the fact that it is still widely used in enterprises. Mainstream support ended in July of this year, following a final update on 28 June.