Microsoft warns web-hosting providers of zero-day flaw

By Janine de Blois

The vulnerability affects Windows XP Service Pack 2 as well as all supported versions and editions of Windows Server 2003, Windows Vista, and Windows Server 2008. It allows for elevation of privilege from authenticated user to LocalSystem.

An attack is possible through authenticated user provided code. Internet Information Services (IIS) and SQL Server are affected.

As yet, no known attacks have exploited this vulnerability. Microsoft is working on the problem. A patch will be released in appropriate manner when it has been developed.