Microsoft has proposed a number of mitigations for a recently disclosed zero-day that could be used to take control of older Windows machines.
News of the vulnerability spread last week when Maurycy Prodeus of iSec Security Research posted information about the vulnerability on the Web. According to Microsoft’s advisory, the vulnerability is due to the way VBScript interacts with Windows Help files when using Internet Explorer. If a malicious Website displays a specially crafted dialog box and a victim is tricked into pressing the F1 key, malicious code could be executed with the rights of the logged-on user, Microsoft explained.
As part of its investigation, Microsoft determined the issue only impacts Windows 2000, Windows XP and Windows Server 2003 through Internet Explorer. As of March 1, Microsoft was not aware of any attacks leveraging the situation, blogged Jerry Bryant, the company’s senior security communications manager lead.
“Our teams are working to address the issue and once we complete our investigation, we will take appropriate action to protect customers,” he added. “This may include releasing an update out-of-band.”
To address the issue, Microsoft made a number of suggestions, including restricting access to the Windows Help system. The company warned, however, that if the Windows Help System is rendered unavailable, users may not be able to leverage the help function in applications. The company also suggested users change the local intranet security zone settings to “High” to block ActiveX Controls and Active Scripting, and avoid pressing the F1 key if they are prompted to by a Website.
“The Group Policy setting to ‘Turn off displaying the Internet Explorer Help Menu’ under the category path ‘Computer ConfigurationAdministrative TemplateWindows ComponentsInternet Explorer’ is not a sufficient mitigation for this issue,” according to a post on the company’s Security Research & Defense blog.
While Microsoft offered no timeline for a fix, the next regularly scheduled Patch Tuesday update is slated for March 9.
