Don’t press that F1 button!
March 9, 2010 by Valerie HelmbreckPosted in: In this week's e-newsletter, Latest News & Views, Software, Web browsers, cybercrime, malware
After a few days of head scratching, Microsoft told Windows XP users today not to press the F1 key when prompted by a Web site.
The warning is part of the software giant’s emerging reaction to an unpatched vulnerability that hackers could exploit to hijack PCs that run Internet Explorer.
Microsoft is investigating new public reports of a vulnerability in VBScript that is exposed on supported versions of Microsoft Windows 2000, Windows XP, and Windows Server 2003 through the use of Internet Explorer.
But good news for Vista and Win7 users: Their investigation has shown that the vulnerability cannot be exploited on Windows 7, Windows Server 2008 R2, Windows Vista or Windows Server 2008.
The main impact of the vulnerability is remote code execution.
The vulnerability exists in the way that VBScript interacts with Windows Help files when using Internet Explorer. If a malicious Web site displayed a specially crafted dialog box and a user pressed the F1 key, arbitrary code could be executed.
On systems running Windows Server 2003, Internet Explorer Enhanced Security Configuration is enabled by default, which helps to mitigate against this issue.
Until a patch is ready, users can protect themselves by not pressing the F1 key if a Web site tells them (repeatedly) to do it.
Another workaround: Disable Windows Help by modifying the ACL on winhlp32.exe to be more restrictive on Windows 2000, Windows XP and Windows Server 2003 by running the following command from an administrative command line:
echo Y | cacls "%windir%\winhlp32.exe" /E /P everyone:N
FinanceTechNews.com delivers the latest Finance news once a week to the inboxes of over 150,000 Finance professionals.
Click here to sign up and start your FREE subscription to FinanceTechNews!
March 12th, 2010 at 12:56 pm
“Another workaround: Disable Windows Help by modifying the ACL on winhlp32.exe to be more restrictive on Windows 2000, Windows XP and Windows Server 2003 by running the following command from an administrative command line: ”
Uh, what command would that be?
March 12th, 2010 at 1:19 pm
Sorry Steve, my bad. The end of that post got cut off somehow (probably my stupidity). I’ve updated the post, but here’s the command:
echo Y | cacls “%windir%\winhlp32.exe” /E /P everyone:N
March 16th, 2010 at 5:25 pm
Or a simple Autohotkey script compiled into an Exe and deployed across the enterprise. That way help can still function for other apps.
#NoTrayIcon
#IfWinActive ahk_class IEFrame
F1::
MsgBox ,262144,CMRI ICT Notice,F1 is disabled in Internet Explorer due to a security risk.`n`nUse the Help menu if you do need help on Internet Explorer`n`nSee Network Security Admin for more information.
return
March 18th, 2010 at 3:08 pm
Or one can simply use Firefox and be done with this madness.
April 28th, 2010 at 2:58 pm
oh, marlon…