A security flaw in Microsoft Corp.'s Windows software that leaves computers vulnerable to hijack is linked to February's attack on the website of Super Bowl host Dolphin Stadium, researchers say.

In an advisory issued by Microsoft Thursday, the world's largest software maker said it had confirmed that multiple versions of Windows — including the latest Vista version — contain a flaw in the way the operating system handles animated cursors or pointers.

The animated cursor files end with the filename extension ".ani" and are sometimes used by software such as Microsoft's Office suite and by website developers to enhance or modify the experience of using the computer. The vulnerability could allow an attacker to take control of a computer.

WINDOWS VERSIONS AFFECTED

Vista 2000 SP4 XP SP2 XP 64-bit v. 2003 for Itanium systems XP Professional x64 Server 2003 Server 2003 (Itanium) Server 2003 SP1 Server 2003 SP1 (Itanium) Server 2003 x64

"In order for this attack to be carried out, a user must either visit a website that contains a web page that is used to exploit the vulnerability or view a specially crafted e-mail message or e-mail attachment sent to them by an attacker," Microsoft researcher Adrian Stone wrote in a post to the company's security blog.

The company noted that it has added the ability to detect the flaw to its Windows Live OneCare security software suite and plans to issue a security update for the operating system.

Security software maker McAfee Inc. researcher Craig Schmugar noted in a post to the company's Avert Labs blog Thursday that an attack on the Dolphin Stadium website in February used the same computer script that is now being used to exploit the animated cursor flaw.

The script that was embedded in the Dolphin Stadium web page — and thousands of others — downloaded spyware from a server registered in China, giving attackers full access to a victim's computer.