Cracked Windows – Microsoft warns of critical flaw

Microsoft has published a security advisory warning of a critical vulnerability in Microsoft DirectX on older versions of Windows.

The problem is in the way that Microsoft DirectShow handles QuickTime format files – meaning that if a user opened a maliciously crafted QuickTime media file, the hackers could run dangerous code on your computer.

According to Microsoft, all versions of Windows Vista and Windows Server 2008 are not vulnerable but Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are affected.

A proper patch for the problem is not yet available, but the company has issued a workaround that can be used by vulnerable Windows users.

The workaround, which disables QuickTime parsing, involves making changes to the Registry. But if the thought of doing that gives you goosebumps, they’ve produced a natty automated method that will do it for you. All you need to do is click on a “Fix It” button on their site to run the workaround.

More information about the flaw can be found in Sophos’s analysis of the problem.

There’s no word yet on when Microsoft will make available a proper fix for this problem, or indeed whether it will be included in their regular scheduled “Patch Tuesday” bundle of patches next month or released as an out-of-bound fix.

But I think it’s good that they gave the less geeky users of computers a fairly easy way to implement the workaround, rather than leaving them befuddled by complicated instructions.

by Graham Cluley, Sophos