Gtron Solutions, LLC

A new flaw that could possibly put websites in harm's way in being investigated by Microsoft, and they have issued an advisory for the vulnerability. The affected OSes are: Windows XP Professional SP2, Windows Server 2003, Windows Vista and Windows Server 2008. The root of the problem lies within the OS's handling of code in the Internet Information Services (IIS) and SQL Server.

Successful exploitation could allow for a hacker to elevate their access privileges to those of the LocalSystem administration tool. The most susceptible to this attack would be companies that use a considerable amount of user-provided code, such as site hosts. The security experts are already getting out the word about the possibility of an attack through this flaw, but at this point Microsoft has not received any reports speaking of the vulnerability being marked. McAfee researcher Karthik Raman said "The vulnerability is limited to a local privilege escalation, but IIS' susceptibility is concerning," and "The web server is widely used on the internet, and is a top pick by web-hosting providers. We might see web-hosting providers targeted, and their clients' websites breached." As they are still examining the evidence Microsoft has yet to make a decision as to whether to wait for the next Patch Tuesday on May 13th to address the flaw or to issue a patch immediately.

REFERENCES:
vnunet.com
Microsoft warns of web server flaw