Security threats Toolkit

Story: Microsoft to patch DirectX hole

• 
• 

vulnerability is automatically being activated without user intervention

This vulnerability involving a Direct X component of Microsoft’s Windows QuickTime Parser is facilitating current drive-by hacking incidents. It is reported that the vulnerability is automatically being activated without user intervention when a user simply browses a website that contains a maliciously crafted QuickTime file and can provide the hacker with complete control over the compromised PC.

Windows 2000, XP and Server 2003 users are at risk and as Vista and later versions of Windows do not use the vulnerable code “QuickTime Parser” they are not impacted.

Microsoft has taken a rather unique approach to the issue by setting up a Web link that can automatically make the necessary registry changes to facilitate a workaround until a patch is officially released.

Home users are encouraged to use the Microsoft automatic workaround solution & enterprise users should consider an immediate implementation of the managed deployment script in order to maximise risk mitigation until an official patch is released by Microsoft.

• 
• 

• 
• 
• 

Full Talkback thread