Tavis Ormandy discovered an old vuln in Windows Help Center that allows an attacker to run an arbitrary command on your machine. This only applies to older operating systems like Windows 2003 and Windows XP. Tavis alerted Microsoft to the problem. Then he went public with his info.The real hack here is that people are making a big deal about Tavis being employed by Google. Supposed reported are making it look like Tavis reported the hole to Microsoft and immediately shared the zero day with the world before Microsoft could patch the hole. Imagine that. Reporters are hacking security consultants with their stories. What will they think of next?
You can find a lot of technical details on the original vulnerability from SecLists. They even disassemble the Windows Help Center executable code, and show you how the arbitrary commands can get through the parsing. That is some deep stuff.
