The ad hoc Zeroday Emergency Response Team has posted a Vector Markup Language (VML) patch for versions of Windows that Microsoft no longer supports, including Windows 98 and Windows Millennium, as well as the original 2001 build of Windows XP.
ZERT, which issued an unsanctioned patch for the VML bug in supported operating systems several days before Microsoft rolled out its official fix, is a loose group of 20-plus security professionals and researchers from the U.S., Germany, Russia, and elsewhere. Its mission: step in with fixes to critical flaws when vendors are slow to react.
The new patch fixes the VML flaw in Windows 98, 98 SE, Millennium, 2000 SP3, and Windows XP (pre-SP1). None of those operating systems are supported by Microsoft, and so are not patched against even the most serious vulnerabilities.
Support for Windows XP SP1 (and SP1a) will end as of Oct. 10, Microsoft has reminded users several times this year.
The ZERT fix can be downloaded from the group's Web site.