Microsoft Announces Patch for “Help Flaw” Security Hole   1/11/2005 - 953 views, 1 Comment

Making this flaw even more devestating than some others is the fact that it affects so many flavours of Windows, including version of 98, 98 SE, XP, ME, 2000, and Windows Server.

Worse, this is one of the security holes for which the “how to exploit it” instructions were posted on at least one, maybe two or more websites, making the need for a fix extra-critical. Indeed, security companies were recommending that users disable Active X until a fix was offered.

Well, the fix is now being offered by Microsoft, who says of this particular flaw and fix:

“A vulnerability exists in the HTML Help ActiveX control in Windows that could allow information disclosure or remote code execution on an affected system. This vulnerability is documented in the Vulnerability Details section of this bulletin.

If a user is logged on with administrative privileges, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full privileges. Users whose accounts are configured to have fewer privileges on the system could be less impacted than users who operate with administrative privileges.

We recommend that customers install the update immediately.”

Aunty recommends so too, and you can get the patch here.