Microsoft is warning users and administrators of a new exploit that could allow an attacker to control which sites a user can visit.
The vulnerability lies within the Web Proxy Auto Discover (WPAD) component used to connect a PC to a web proxy server.
Microsoft disclosed the flaw earlier this year and issued a patch. The company has also issued a tutorial for administrators on how to configure DNS servers to prevent attackers from setting up the malicious proxy.
An attacker could exploit the security hole through a specially crafted website or email message that installs a malformed WPAD file on the user's system.
The malicious file then directs the user's PC to connect to a Domain Name System or Windows Internet Names Service server run by the attackers, giving them total control over their internet traffic.
Vince Wong, a group product manager for Symantec, said that the ramifications of a user running through an attacker's proxy would be similar to those of a cross-site-scripting attack.
Users could be redirected to phishing sites or sent to pages that may attempt to exploit other vulnerabilities.
Although there is little danger at the moment, users should install Microsoft's latest patches and keep their security software up to date, he recommended.
"Patching this is highly recommended, and it is almost critical at this point," Wong told vnunet.com.
"Right now it's a low risk, but it's not unimaginable that unsuspecting users could get duped."
Warming was most pronounced in Siberia region
The tank will be subjected to high stresses and loads via dozens of hydraulic cylinders during testing
'Sunlit wet sidewalk' provides evidence of methane rainfall on the north pole of Saturn's moon Titan
Methane rainfall indicates the start of the summer season in Titan's northern hemisphere
Scientists believe there could be other hydrides or superhydrides with super conducting properties