Expected Exploit For Windows Media Player Flaw Hits

UPDATE: This story was updated at 4:54PM ET Thursday.

An exploit against the Windows Media Player vulnerability disclosed by Microsoft two days ago is nearly finished, a security company said Thursday, and may be only hours away from hitting unpatched users.

The bug, which was made public Tuesday in security bulletin MS06-005, allows attackers armed with malicious .bmp image files to hijack Windows PCs.

"There are two exploits circulating," said Mike Puterbaugh, the vice president of marketing at eEye Digital Security, the Aliso Viejo, Calif.-based company which first uncovered the Media Player vulnerability.

"One is somewhat minor, and can cause a denial-of-service, but the second we're taking far more seriously," said Puterbaugh. "It's 95 percent there as a propagated mass attack.

"All the guy needs to do is add shell code to it to remotely exploit machines."

The exploit, which was posted to the Bugtraq security mailing list is "minutes or days from being completed," Puterbaugh said. "The exploit hasn't been able to reliably write to the same part of memory every time, but once he gets that, it's game over."

The exploit's author -- identified only as "ATmaCA" -- claimed that the attack would work against Windows 98, Millennium, 2000, NT, XP, and 2003 Server systems. He also acknowledged that he was having trouble wrapping up the exploit.

"In this vulnerability, payload is loaded to different places in memory each time," a comment in the proof-of-concept code read. "But some time is very easy to call our shell code…but some times not."

While experts believed that the Windows Media Player flaw would be used by spyware and adware purveyors to silently install malicious software, as they had used the Windows Metafile bug that surfaced in December 2005, Puterbaugh said eEye's researchers believed ATmaCA would package the exploit into a mass-mailed, and self-propagating, worm.

Users can download Microsoft's patch via Windows Update, Microsoft Update, or direct from the developer's Download Center.