WinXP Security Vulnerability System 1

  

I. Task Scheduler Vulnerability

Vulnerability Description: Windows Task Scheduler has problems in processing application file name verification. Hackers can use this vulnerability to remotely obtain system permissions. Execute arbitrary instructions. Hackers can use a variety of methods, such as constructing a malicious WEB page entice users to click to trigger the vulnerability, a hacker successfully exploited this vulnerability could take complete control of an affected system.

"Workaround": Microsoft has released a security bulletin (MS04-022) and corresponding patches for this purpose. Users who have installed WinXP and WinXP Service Pack 1 immediately go to the following address http://www.microsoft. Download the patch at com/china/technet/security/bulletin/MS04-022.mspx and update it. This security patch will also be included in Windows XP Service Pack 2.

Second, HTML Help Remote Code Execution Vulnerability

"Vulnerability Description": Windows allows applications to display and process help files using a standard method (such as the HTML Help API method). There is a problem with Windows HTML Help. Remote hackers can exploit this vulnerability to execute arbitrary code on the system with user process privileges, including installing programs, viewing changes to delete data, and creating new accounts. Hackers can build malicious pages, entice users to click to trigger this vulnerability, and a specially built showHelp URL can also cause remote arbitrary code to be executed on a local computer.

"Solutions": Microsoft has released a security bulletin (MS04-023) and corresponding patches for this purpose. Users who have installed WinXP and WinXP Service Pack 1 immediately go to the following address http://www.microsoft. Download the patch at com/china/technet/security/bulletin/MS04-023.mspx and update it. The patch for this issue will also be included in Windows XP Service Pack 2.

If you can't install the patch or upgrade immediately, it is recommended to click Start, run "regsvr32 /u %windir%\\system32\\itss.dll", and log out of the HTML Help protocol to reduce the threat. If you are using Outlook 2002 or higher, or Outlook Express 6 SP1 or higher, read the email in plain text format to avoid being attacked by malicious HTML code.

Copyright © Windows knowledge All Rights Reserved