Microsoft is investigating a newly reported flaw that could put websites at risk of attack, affected operating systems include Windows XP Professional SP2, Windows Server 2003, Windows Vista and Windows Server 2008. For a full list visit the Microsoft Knowledge Base article 951306

Microsoft has warned that companies that make extensive use of user-provided code, such as site hosts, are especially vulnerable.

The problem exists in Windows’ handling of code within its Internet Information Services (IIS) and SQL Server. If exploited, the vulnerability could allow a user to elevate access privileges to that of the LocalSystem administration tool. A Microsoft security advisory has been released about this issue and can be found here

Microsoft has yet to receive any reports of the vulnerability being targeted, but security experts have already warned of a possible attack.

.