Serious Windows flaw found in all versions

A top Microsoft security official, Steve Lipner, said the vulnerability was being discussed openly among experts on the Internet when Microsoft learned about the flaw early in January.

Internet security company, iDefense Inc. of Chantilly, Va., said Wednesday it learned about the flaw in December 2002 from Roland Postle, a respected British computer security researcher widely known as "Blazede," and passed the information to Microsoft on Jan. 9.

But iDefense also immediately and quietly warned its clients, which include large corporations and U.S. agencies, before Microsoft could fix the problem.

Microsoft and iDefense said they were unaware of any reports that hackers already had used the technique to break into computers, even though months had passed between the disclosure of the flaw and Wednesday's announcement that it could be fixed.

Russ Cooper, a security expert for TruSecure Corp., based in Herndon, Va., predicted that antivirus software will be updated to protect users who might receive infected e-mails and that Web sites with infected pages would be shut down quickly once they are detected.

The problem involves tricking Windows into processing unsafe code built into a Web page or e-mail message. It was particularly unusual because it affected so many different versions of Windows, from Windows 98 to Windows XP.

Lipner confirmed that the faulty software code was created years ago and included in every successive generation of Windows software without programmers ever realizing it was so seriously flawed.

There was some good news. Microsoft said customers using the newest versions of Outlook Express 6 and Outlook 2002, were protected from hackers.<