In a Web-based attack scenario, an attacker would have to host a Web site that contains a Web page that is used to exploit this vulnerability. An attacker would have no way to force users to visit a malicious Web site. Instead, an attacker would have to convince them to visit the Web site, typically by getting them to click a link that takes them to the attacker’s Web site. After they click the link, they would be prompted to perform several actions. An attack could only occur after they performed these actions.

An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

The hackers are already attacking this hole with “limited attacks,” Microsoft says. If this is half as bad as it sounds, I’d expect such attacks to increase. While no patch is out yet, Microsoft has made a quick “Fix-It” option available to temporarily disable Windows parsing of QuickTime files.

To get the fix, visit this Microsoft support page and click the “Fix this problem” button under the “Enable workaround” heading. You’ll then download a file which, when run, will modify the Registry to protect against this flaw. Later, after Microsoft has released a patch to permanently fix the hole, you can click the “Disable workaround” link on the same page to reverse the change.

Before reformatting, in My Computer, double click the drive letter on which you installed XP, and navigate to WINDOWS\System32. Click “Show the contents of this folder” if necessary. Copy the following files to a floppy, USB drive, CD/DVD or network location: wpa.dbl and wpa.bak. After reformatting and reinstalling XP, select NO when asked if you want to activate Windows now.

Restart in Safe Mode. In My Computer, open the WINDOWS\System32 folder and rename the existing wpa.dbl and wpa.bak files (if you have them). Now copy your old wpa.dbl and wpa.bak files to the System32 folder.

Restart and you should not be requested to activate again. This only works when you reinstall Windows on the same computer and the hardware remains the same.