Gtron Solutions, LLC

A vulnerability in DirectX that runs QuickTime files has been recently discovered by Microsoft who immediately warned users not to click on suspicious links.

In its advisory posted last Thursday, Microsoft said attackers use malicious QuickTime files to allow them to compromise the system by stealing user rights.

Microsoft said the attacks are “limited” but still asked users to employ measures to protect their system, including constantly updating their software.

“The vulnerability could allow remote code execution if a user opened a specially crafted QuickTime media file. Microsoft is aware of limited, active attacks that use this exploit code,” said the advisory.

Microsoft said that Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are vulnerable to these attacks but that all versions of Windows Vista and Windows Server 2008 are not vulnerable.

The Microsoft Security Response Center has assured users that they are now putting together a patch for the vulnerability.

In its group blog, MSRC said they made an initial investigation that showed that “it is possible to direct calls to DirectShow specifically, even if Apple’s QuickTime-which is not vulnerable-is installed.”

In its advisory, Microsoft also said it “will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.”