Hundreds, if now not thousands, of web sites are actively exploiting the Windows cursor flaw that Microsoft patched last week. It seems many of the web sites that have been targeted are being used because they’re popular with World of Warcraft players and the attackers want to gain access to their WoW accounts.

It is estimated that hundreds of thousands of systems have been compromised by the cursor flaw since December 2006 and the number of infected users remains to rapidly increase since the patch was released.

At the moment there still are hundreds of websites hosting malicious code that exploits the latest vulnerability, and spammers have continued mass-mailing campaigns spreading infected messages. Although Microsoft has known about the problem since December 2006, it released the fix only after widespread attacks exploiting the cursor flaw began in late March. While it only took Microsoft a couple of days to react by releasing the patch once attacks were verified, there has also been some criticism that it actually took three months for the fix to see the light of day. And despite the early release, Microsoft’s patching program for April has just began: next week’s scheduled release will contain fixes for at least five vulnerabilities, with a number of critical updates expected.

Microsoft’s inability to release fixes for critical patches like this put every Windows user at risk of not only having their WoW account stolen but also real financial accounts and their personal information which can lead to identity theft.

[Gamers targeted by Windows cursor flaw attacks]

[tags]zero-day vulnerabilities, zero-day, World of Warcraft, WoW, windows cursor, microsoft windows, microsoft[/tags]