Microsoft probing reported flaws in Windows XP SP2

Microsoft Corp. Thursday said it is investigating claims that several new vulnerabilities have been found in Windows XP Service Pack 2 by security firm Finjan Software Inc. in San Jose, Calif. Finjan on Tuesday announced that it had found as many as 10 "serious" flaws in SP2.

According to Gil Arditi, Finjan's chief security officer, some of the vulnerabilities could be exploited by hackers to gain complete remote control of a system or to download malicious code to a compromised computer.

Finjan has notified Microsoft of the vulnerabilities and has shared all relevant technical details with the company, Arditi said. Finjan has also developed a proof-of-concept exploit capable of taking advantage of the flaws, which it has shared with Microsoft.

Per its usual policy, Finjan has no plans to go public with details of the flaws until Microsoft has patches available for them, Arditi said. But in a release announcing its discovery, the security company outlined several scenarios describing how malicious attackers could take advantage of the SP2 holes to remotely access user files, escalate privileges and execute malicious code without user intervention.

"By exploiting all vulnerabilities discovered in SP2 by Finjan, attackers can silently and remotely take over an SP2 machine when the user simply browses a Web page," the company said in a statement.

Finjan said it released the news of its discovery in part because many users are being lulled into a feeling of false security by deploying SP2 and "may be letting their guard down," said Tim Warner, Finjan's north European regional manager.

In an e-mail statement, a Microsoft spokeswoman said the company is aware of the claims by Finjan and is looking into them. "At this time, Microsoft cannot confirm Finjan's claims of '10 new vulnerabilities' in Windows XP SP2," she said.

Microsoft is also currently unaware of any attacks attempting to take advantage of the flaws described by Finjan, the spokeswoman said. "Our early analysis indicates that Finjan's claims are potentially misleading and possibly erroneous regarding the breadth and severity of the alleged vulnerabilities in Windows XP SP2," the Microsoft statement said.

If any valid vulnerability is found in Windows XP SP2, Microsoft said it will take "immediate and appropriate action to help protect customers."