Microsoft Investigating New Internet Explorer Flaw
By Kevin Parrish, published on March 1, 2010
" Another bug was found in Internet Explorer. Oh yay.
The Microsoft Security Response Center issued a warning Friday indicating that users of Internet Explorer 6, 7 and 8 are vulnerable to malware through an un-patched bug in VBScript. The exploit was originally uncovered by Polish security analyst Maurycy Prodeus of iSEC Security Research. He said that the flaw only resides within Windows XP SP3--all other versions of Windows are not affected by the vulnerability.
According to this post, it's possible to invoke winhlp32.exe from Internet Explorer which in turn might lead to remote code execution. Attackers could execute malicious code when their fake web pages convince visitors to press the F1 key. The good news is that Microsoft has not received reports on attackers actually using this exploit.
"Windows Help files are included in a long list of what we refer to as unsafe file types," Microsoft reports. "These are file types that are designed to invoke automatic actions during normal use of the files. While they can be very valuable productivity tools, they can also be used by attackers to try and compromise a system."
Microsoft said that it's currently investigating the situation, and will "take appropriate action to protect customers." Microsoft suggests that consumers follow its "Protect your Computer" guidelines by enabling a firewall, applying all software updates, and keeping anti-virus definitions up-to-date.
Still, Windows XP users may want to consider alternate browsers, as Internet Explorer is a high-profile target for malware developers. "
Source: http://www.tomsguide.com/us/Microsof...news-5977.html
Source: 
Bookmarks