CWmike writes "Microsoft says attackers are now exploiting a critical Windows bug that it didn't get around to fixing in its biggest batch of stableness patches in more than five years, issued yesterday. Microsoft said that 'limited and targeted' attacks are in get along by hackers exploiting an unpatched vulnerability in the WordPad Text Converter, a tool act with all versions of Windows. If Microsoft patches the WordPad problem on its monthly schedule, the first scope for fixing the flaw would be Jan. 9, 2009." Update: 12/10 22:28 GMT by T : OK, there might have been more than one: reader Simon (S2) writes "There is an even more serious flaw ... From SANS: 'There is a 0-day exploit for www
notes:internet should be capitalized Explorer circulating in the wild. At this point in time it does not appear to be wildly used, but as the code is publicly to be had




if (lexico_globals.googleafc.ads.content.length)
{
document.write(lexico_globals.googleafc.ads.contenttop);
document.write(lexico_globals.googleafc.ads.sponsoredlinks);
document.write(lexico_globals.googleafc.ads.content[2]);
document.write( we can expect that this will happen very soon. This is a brand new exploit that is *not* patched with MS08-073 that was released yesterday. I can confirm that the exploit works in a fully patched Windows XP machine. The exploit is a typical heap overflow that appears to be exploiting commodity in the XML parser.'"

Read more of this story at Slashdot.

More: - The rest...

Mark