Microsoft Warns Windows XP Users To Avoid F1 Key In Internet Explorer

2010 has not been kind to Microsoft's security team. In under a month'stime, we've seen Microsoft address a bug that was supposed to fix anancient exploit but instead caused more headaches, all while having toencourage consumers not to be duped by a fake security site paradingaround as something useful. As if those software savvy folks up inWashington didn't have enough on their plates, the company has todayissued yet another startling advisory, and this is easily one of themore bizarre ones that we've seen.

Microsoft has gone public with an investigation into a "a vulnerabilityin VBScript that is exposed on supported versions ofMicrosoft Windows 2000, Windows XP, and Windows Server 2003 through theuse of Internet Explorer." This is quite significant because a hugemajority of PCs in the world still rely on Windows XP, and manycorporate environments haven't upgraded or switched away from IE. Todate, Microsoft has yet to find evidence that this exploit could harmWindows 7, Vista or Server 2008 users.


The primary problem that we're dealing with here is "remote codeexecution," and while the company admits that they aren't aware of anyattacks that take advantage of the vulnerabilities, they're obviouslylooking to patch things up before it gets bad. Here's Microsoft's exactexplanation of the issue:

The vulnerability exists in the way that VBScript interacts withWindows Help files when using Internet Explorer. If a malicious Website displayed a specially crafted dialog box and a user pressed the F1key, arbitrary code could be executed in the security context of thecurrently logged-on user. On systems running Windows Server 2003,Internet Explorer Enhanced Security Configuration is enabled by default, which helps to mitigate against this issue.

Did you catch that? The part about the "F1" key? In a few words,Microsoft is actually advising Windows XP users who rely on IE to notuse their F1 key, which is kind of crazy when you think about it.Thankfully, not many people actually rely on the F1 key in day-to-dayuse, but just imagine the outrage if "F1" were replaced with "A." Thepublic is being told that the problem is being worked on, though thereis no time table given as to when we can expect a fix. Just push thoseF1 urges aside from awhile, and everything should be just fine.