In an advisory issued March 1, Microsoft served up a handful of workarounds to plug a security hole caused by an unpatched zero-day. According to Microsoft, the issue affects Windows XP, Windows 2000 and Windows Server 2003, and could be exploited to hijack vulnerable systems.
Microsoft has proposed a
number of mitigations for a recently disclosed zero-day that could be used
to take control of older Windows machines.
News
of the vulnerability spread last week when Maurycy Prodeus of iSec Security
Research posted information about the vulnerability on the Web. According
to Microsoft's advisory, the vulnerability is due to the way VBScript
interacts with Windows Help files when using Internet Explorer. If a malicious
Website displays a specially crafted dialog box and a victim is tricked
into pressing the F1 key, malicious code could be executed with the rights
of the logged-on user, Microsoft explained.
As part of its
investigation, Microsoft determined the issue only impacts Windows 2000,
Windows XP and Windows Server 2003 through Internet Explorer. As of March 1,
Microsoft was not aware of any attacks leveraging the situation, blogged
Jerry Bryant, the company's senior security communications manager lead.
"Our teams are working to
address the issue and once we complete our investigation, we will take
appropriate action to protect customers," he added. "This may include releasing
an update out-of-band."
To address the issue,
Microsoft made a number of suggestions, including restricting access to
the Windows Help system. The company warned, however, that if the Windows
Help System is rendered unavailable, users may not be able to leverage the help
function in applications. The company also suggested users change the
local intranet security zone settings to "High" to block
ActiveX Controls and Active Scripting, and avoid pressing the F1 key if they
are prompted to by a Website.
"The Group Policy setting to 'Turn off displaying the Internet Explorer
Help Menu' under the category path 'Computer Configuration\Administrative
Template\Windows Components\Internet Explorer' is not a sufficient mitigation
for this issue," according to a post on the company's Security Research
& Defense blog.
While Microsoft offered no timeline for a fix, the next regularly
scheduled Patch Tuesday update is slated for March 9.
Email
Print
