Software Engineering Institute

Microsoft Agent is a software extension that enhances user interaction through the use of interactive personalities in the form of animated characters. Applications and web pages can be programmed to invoke Microsoft Agent to make navigation and other tasks easier and more natural for the user.

A flaw in Microsoft Agent allows security prompts to be disguised by a Microsoft Agent character. As a result, users could be led to believe that they are accessing trusted Internet content when, in fact, they are accessing malicious Internet content. The user could subsequently be convinced to unintentionally allow the installation of malicious software. A remote attacker with the ability to craft a malicious web page and persuade or trick a user into visiting it could exploit this vulnerability.

An attacker could spoof trusted Internet content, resulting in the installation of malicious code on the victim system.

Apply a patch

Microsoft has published Microsoft Security Bulletin MS05-032 in response to this issue. Users are encouraged to review the bulletin and apply the patches it refers to.

Workarounds

In addition to the patches referenced above, Microsoft Security Bulletin MS05-032 also contains workaround information to mitigate this issue. Users, particularly those who are unable to apply the patches, should consider implementing these workarounds as appropriate.