Technical Information

Brief overview of the risk:
Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by the automatic opening of HELP (.hlp) files by the VBScript MsgBox() function in winhlp32.exe.
Detailed Information on the risk:
The vulnerability exists in the way that VBScript interacts with Windows Help files when using Internet Explorer. If a malicious Web site displayed a specially crafted dialog box and a user pressed the F1 key, arbitrary code could be executed in the security context of the currently logged-on user. On systems running Windows Server 2003, Internet Explorer Enhanced Security Configuration is enabled by default, which helps to mitigate against this issue.Further information on this exploit is available at : (981169)