The flaw in the quartz.dll processor in the DirectShow platform affects Windows XP, 2000 and Server 2003. Windows Vista, Server 2008 and Windows 7 are not affected. Crooks can go after the hole even if you have Apple's Quicktime installed, according to Microsoft.

Also, while opening a malicious QuickTime file could trigger the flaw, it's not required. According to a at its Security Response Center, "a browser-based vector is potentially accessible through any browser using media plug-ins that use DirectShow." So a may be possible, which can execute an attack in the background if you simply visit a malicious page.

The bad guys are already attacking this hole with "limited attacks," Microsoft says, but if this is half as bad as it sounds I'd expect such attacks to increase. While there isn't yet any patch available, Microsoft has made a quick "Fix-It" option available which can temporarily disable Windows parsing of QuickTime files.

To get the fix, visit and click the Fix It button under the "Enable Workaround" heading. You'll then download a file which, when run, will modify the registry to protect against this flaw. Later, after Microsoft has released a patch to permanently fix the hole, you can click use the "Disable Workaround" link on the same page to reverse the change.

For more information, see , along with posts on the and blogs.