Microsoft Warns Of Zero-Day Flaw For Old Windows Machines

Microsoft has issued a handful of workarounds to plug a security hole caused by an unpatched zero-day flaw that could be used to take control of older Windows machines.

News of the vulnerability spread last week when Maurycy Prodeus of iSec Security Research posted information about the vulnerability on the web. According to Microsoft’s advisory, the vulnerability is due to the way VBScript interacts with Windows Help files when using Internet Explorer. If a malicious website displays a specially-crafted dialog box and a victim is tricked into pressing the F1 key, malicious code could be executed with the rights of the logged-on user, Microsoft explained.

As part of its investigation, Microsoft determined the issue only impacts Windows 2000, Windows XP and Windows Server 2003 through Internet Explorer. As of 1 March, Microsoft was not aware of any attacks leveraging the situation, blogged Jerry Bryant, the company’s senior security communications manager lead.

“Our teams are working to address the issue and once we complete our investigation, we will take appropriate action to protect customers,” he added. “This may include releasing an update out-of-band.”

To address the issue, Microsoft made a number of suggestions, including restricting access to the Windows Help system. The company warned however that if the Windows Help System is rendered unavailable, users may not be able to utilise the help function in applications. The company also suggested user change the local intranet security zone settings to “High” to block ActiveX Controls and Active Scripting, and avoid pressing the F1 key if they are prompted to by a website.

“The Group Policy setting to “Turn off displaying the Internet Explorer Help Menu” under the category path “Computer Configuration\Administrative Template\Windows Components\Internet Explorer\” is not a sufficient mitigation for this issue,” according to a post on the company’s Security Research & Defense blog.

While Microsoft offered no timeline for a fix, the next regularly scheduled Patch Tuesday update is slated for 9 March.