Microsoft issues 'critical' advisory

Microsoft has released a 'critical' advisory about its JScript script engine. The problem affects all PCs using Windows 98 and above.

The software giant confirmed that the Windows scripting engine has a flaw which could allow a hacker to embed code in a specially designed web page.

Web surfers' PCs would be automatically infected when they visited the page.

The alert was the first of two issued today. The second vulnerability carries only a 'moderate' warning and concerns a flaw in ISA Server's DNS Intrusion Detection Filter.

If exploited the flaw could be used to mount denial of service attacks against DNS servers.

"It's actually a pretty straightforward problem," said Simon Conant, security specialist at Microsoft.

"The JScript flaw is critical but it's an easy fix and, as for the other advisory, there aren't that many companies with wide-scale deployment so we're anticipating minimal impact."

This brings the number of security advisories at Microsoft to three this week, after an otherwise calm March. Details and patches can be found here.