Microsoft has taken the rare step of warning about a serious computer security vulnerability it hasn’t yet fixed. This vulnerability affects Internet Explorer users whose computers run either Windows XP or Windows Server 2003, and can enable hackers to remotely take control of victims’ machines. The victims don’t need to do anything to get infected except visit a Web site that’s been hacked.

According to security experts, criminals have been exploiting this vulnerability for nearly a week. Thousands of sites have been hacked, and people are drawn to these sites by clicking a link in spam e-mail (mom was right about candy and strangers). The so-called “zero day” vulnerability affects a component of MS software used to play video. The problem arises from the way the software interacts with Internet Explorer, which opens a hole for hackers to tunnel into.

Microsoft has urged vulnerable users to disable the problematic part of its software, which can be done from Microsoft’s Web site, while the company works on a “patch” for the problem.

Source: MSNBC