Ubisoft has been forced to release an emergency patch to fix a security hole discovered in its Uplay application. The Uplay copy protection system from the game publisher Ubisoft comes with a browser plugin that tears a huge security hole in the computer. It is possible for attackers to use JavaScript to persuade the plugin to launch arbitrary processes. The problem was discovered by Google security expert Tavis Ormandy, who, while on vacation, bought "Assassin's Creed Revelations" and reported his observations on the Full Disclosure mailing list:

"While on vacation recently I bought a video game called Assassin's Creed Revelations. I didn't have much of a chance to play it, but it seems fun so far.

"However, I noticed the installation procedure creates a browser plug-in for it's accompanying Uplay launcher, which grants unexpectedly (at least to me) wide access to websites."

Uplay is a system that allows gamers to earn points and rewards for performance which are logged online. The Uplay software is bundled with major titles like Assassin's Creed.

"We recommend that all Uplay users update their Uplay PC application without a Web browser open," Ubisoft said.

"This will allow the plug-in to update correctly.

"An updated version of the Uplay PC installer with the patch also is available from Uplay.com."