Microsoft warned of a new hole on Monday that could be exploited by attackers to take control of older Windows systems running Internet Explorer and for which proof-of-concept exploit code has been released publicly.
The vulnerability affects Windows 2000-, XP- and Server 2003-based systems. It exists in the way that Visual Basic Scripting, or VBScript, interacts with Windows Help files, Microsoft said in its security advisory. VBScript is an Active Scripting language for executing functions embedded in web pages.
In an attack scenario, victims would somehow be lured to visit a malicious website that displays a specially crafted dialog box, Microsoft said. The box could prompt visitors to press the F1 key, which would install malware on the visitor's computer when pressed. The F1 key is used to bring up the help function.
For more on this story, see Microsoft warns of zero-day hole for older Windows on CNET News.
