You know it has some attention if the security advisory is released on a weekend.
Tonight Microsoft released Security Advisory 2794220 to address an issue that can cause remote code execution for users of IE6, IE7 and IE8.
According to Microsoft they are only aware of a few attacks right now. They do confirm that IE9 and IE10 are not impacted so one solution to this vulnerability is to upgrade to one of these two versions to keep this issue from affecting you.
The Microsoft Security team is continuing to look into this issue and provide a series of steps that can help prevent the issue from occurring on your system:
- Set Internet and local intranet security zone settings to “High” to block ActiveX Controls and Active Scripting in these zones
This will help prevent exploitation but may affect usability; therefore, trusted sites should be added to the Internet Explorer Trusted Sites zone to minimize disruption.- Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and local intranet security zones
This will help prevent exploitation but can affect usability, so trusted sites should be added to the Internet Explorer Trusted Sites zone to minimize disruption.- Deploy the Enhanced Mitigation Experience Toolkit (EMET)
This will help prevent exploitation by providing mitigations to protect against this issue and should not affect usability of websites.An easy guide for EMET installation and configuration is available in KB2458544.
If you want to read more details on the vulnerability and how they are going to fix it then check out vulnerability affecting Internet Explorer 8 users on the Security Research and Defense Blog.
