Microsoft Security Bulletin MS03-008 reports that a heap overflow flaw in the Windows Script Engine for Jscript (specifically, Jscript.dll) can allow an attacker to run arbitrary code on a vulnerable system if the user visits a Web page containing the malicious code or opens an HTML e-mail. Jscript, the Microsoft object-oriented version of the JavaScript (aka ECMAScript) scripting language, is an interpreted language, so it can run only in the presence of Active Server Pages, IE, or Windows Script Host. Since the Windows Script Engine is present even if IE is not in use, the use of a different Web browser offers no protection.
|