Cracked Windows – Microsoft warns of critical flaw

Fix It
Microsoft has published a security advisory warning of a critical vulnerability in Microsoft DirectX on older versions of Windows.

The problem is in the way that Microsoft DirectShow handles QuickTime format files – meaning that if a user opened a maliciously crafted QuickTime media file, the hackers could run dangerous code on your computer.

According to Microsoft, all versions of Windows Vista and Windows Server 2008 are not vulnerable but Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are affected.

A proper patch for the problem is not yet available, but the company has issued a workaround that can be used by vulnerable Windows users.

Sign up to our free newsletter.
Security news, advice, and tips.

The workaround, which disables QuickTime parsing, involves making changes to the Registry. But if the thought of doing that gives you goosebumps, they’ve produced a natty automated method that will do it for you. All you need to do is click on a “Fix It” button on their site to run the workaround.

More information about the flaw can be found in Sophos’s analysis of the problem.

There’s no word yet on when Microsoft will make available a proper fix for this problem, or indeed whether it will be included in their regular scheduled “Patch Tuesday” bundle of patches next month or released as an out-of-band fix.

But I think it’s good that they gave the less geeky users of computers a fairly easy way to implement the workaround, rather than leaving them befuddled by complicated instructions.

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.