Microsoft warns of serious computer security hole

Microsoft has taken the rare step of warning about a serious computer-security vulnerability it hasn't fixed yet.

The vulnerability disclosed Monday by the Redmond-based software company affects Internet Explorer users whose computers run the Windows XP or Windows Server 2003 operating software.

It can allow hackers to remotely take control of users' machines. The users don't need to do anything to get infected except visit a Web site that's been hacked.

"We are aware of limited, active attacks that exploit this vulnerability," Christopher Budd, a Microsoft spokesman, said in a statement.

Security experts say criminals have been attacking the vulnerability for nearly a week. Thousands of sites have been hacked to serve up malicious software that exploits the vulnerability.

People are drawn to these sites by clicking a link in spam e-mail.

The so-called "zero day" vulnerability affects a part of Microsoft's software used to play video.

The problem arises from the way the software interacts with Internet Explorer, which opens a hole for hackers to tunnel into.

Microsoft urged vulnerable users to disable the problematic part of its software, which can be done from Microsoft's Web site, while the company works on a patch for the problem.

The company is also urging Windows Vista and Windows Server 2008 users to disable the problem parts of the software.

Microsoft rarely departs from its practice of issuing security updates the second Tuesday of each month. When the company does issue security reminders at other times, it's because the vulnerabilities are very serious.

A recent example was the emergency patch Microsoft issued in October for a vulnerability that criminals exploited to infect millions of PCs with the Conficker worm.

While initially feared as an all-powerful doomsday device, that network of infected machines was eventually used for mundane moneymaking schemes such as sending out spam and pushing fake anti-virus software.

Seattle Times technology reporter Sharon Pian Chan contributed to this report.