Stefan Mileschin

Whether you see Windows Vista and Windows 7 Gadgets as handy tools or a blight upon a pristine desktop, you might want to shut them off for safety's sake. Mickey Shkatov and Toby Kohlenberg have found that the desktop widgets' web-based code have flaws that would allow malicious Gadgets, or even hijacked legitimate Gadgets, to compromise a PC without having to go through the usual avenues of attack. Microsoft's short-term answer to the vulnerability is a drastic one, though: a stopgap patch disables Gadgets entirely, leaving just a barren desktop in its wake. There's no word on a Gadget-friendly solution arriving before Kohlenberg and Shkatov present at the Black Hat Conference on July 26th, but we suspect Microsoft's ultimate answer is to move everyone to Windows 8, where Gadgets aren't even an option. We understand the importance of preventing breaches, of course -- we're just disappointed that we'll have to forgo miniature stock tickers and weather forecasts a little sooner than expected.

http://www.engadget.com/2012/07/11/m...security-hole/