Microsoft alerts Windows users to critical flaw in JScript engine

By Steve Malone

Posted on 20 Mar 2003 at 11:25

Software giant Microsoft has issued an alert to Windows users of version 98 and above following the discovery of a flaw in the Windows Script Engine. The vulnerability allows a hacker to run malicious code embedded in a Web page or delivered in an HTML email.

The Windows Script Engine provides Windows operating systems with the ability to execute scripts written in Visual Basic or JScript.

A flaw exists in the way by which the Windows Script Engine for JScript processes information. An attacker could exploit the vulnerability by constructing a web page that, when visited by the user, would execute code with the user's privileges. The web page could be hosted on a web site, or sent directly to the user in email.

Microsoft says that PCs that have active scripting in Internet Explorer disabled are safe. Also malicious HTML emails are blocked by Outlook Express 6.0 and Outlook 2002, and by Outlook 98 and 2000 updated with Outlook Email Security Update.

No further details on the nature of the problem have been released by Microsoft.

Microsoft has classed the vulnerability as 'critical' and recommends that everyone install the patch.

Further information is available at the Microsoft TechNet site.