Microsoft Security Workarounds Available for Zero-Day Vulnerability
In an advisory issued March 1, Microsoft served up a handful of workarounds to plug a security hole caused by an unpatched zero-day. According to Microsoft, the issue affects Windows XP, Windows 2000 and Windows Server 2003, and could be exploited to hijack vulnerable systems.Microsoft has proposed a number of mitigations for a recently disclosed zero-day that could be used to take control of older Windows machines. News of the vulnerability spread last week when Maurycy Prodeus of iSec Security Research posted information about the vulnerability on the Web. According to Microsoft's advisory, the vulnerability is due to the way VBScript interacts with Windows Help files when using Internet Explorer. If a malicious Website displays a specially crafted dialog box and a victim is tricked into pressing the F1 key, malicious code could be executed with the rights of the logged-on user, Microsoft explained.
As part of its investigation, Microsoft determined the issue only impacts Windows 2000, Windows XP and Windows Server 2003 through Internet Explorer. As of March 1, Microsoft was not aware of any attacks leveraging the situation, blogged Jerry Bryant, the company's senior security communications manager lead.