IE Zero-Day Exploit

[Guest]

Microsoft Warns of IE Zero-Day Exploit
http://www.eweek.com/article2/0,1895,1849948,00.asp

Microsoft advisory pre-patch workarounds
http://www.microsoft.com/technet/security/advisory/906267.
mspx

 

[Bill Sanderson]

Here's what the KB article says, in part:
------------------------------------------------------------
The Msdds.dll COM object could cause Microsoft Internet Explorer to
unexpectedly quit. We are investigating a public report of a vulnerability
that affects Internet Explorer. We are not aware of any attack where a
malicious user has tried to use the reported vulnerability. We are not aware
of any customer affect at this point.
------------------------------------------------------------
Note the last two sentences, in particular.

This vulnerability is in a specific DLL file which is not part of a normal
Windows install.

The file in question is MSDDS.DLL. If you do not have this file on your
system you are not vulnerable.

Please read the advisory--second reference. In the workarounds section, the
third workaround is fairly easy to accomplish and should have no possible
adverse effects.