Windows Flaw Opens PCs to Attack

[MSNwar]

A vulnerability in all versions of Windows could allow attackers to use a malicious Web site or HTML e-mail message to trap victims and take control of their PCs, warned Microsoft.

The flaw in the scripting component of the operating system lets attackers run code through the scripting engine as if the program had been executed locally on a PC, allowing them to run their own programs or to take over the system. Microsoft labeled the flaw as critical in its announcement Wednesday.

While the flaw can be found in every version of Windows--from Windows 98 to Windows XP--the potential danger is offset by two factors. Firstly, security measures already in place in e-mail clients are designed to defeat such HTML message attacks. Secondly, exploiting such flaws through Web pages requires that the person under attack actually visit the malicious site.

Full Story and Patch Information: ZDNet Article