Microsoft plans to release an emergency fix tonight for a zero-day vulnerability affecting Internet Explorer versions 6 and 7, the software giant announced.
The out-of-band patch will resolve the bug, which was disclosed earlier this month on the same day Microsoft released its March security updates. The vulnerability currently is being exploited in targeted attacks but the issue is not present in IE8, the newest browser version.
"We recommend that customers install the update as soon as it is available," Jerry Bryant, group manager of response communications at Microsoft, said in a blog post.
As users await the fix, the vulnerability can be mitigated through IE Protected Mode, which is turned on by default in IE7 running on Vista. In addition, Microsoft is offering an automated workaround to mitigate the flaw. This "Fix It" solution mitigates the flaw "by disabling the peer factory class through the modification of a registry key," the company said.
Releasing an out-of-cycle patch is rare but not unheard of for Microsoft, especially with the company's next scheduled patch release not until April 13.
In January, Microsoft closed another IE hole, which was leveraged in the Google-China attacks, with an emergency fix.
See original article on scmagazineus.com
Microsoft to deliver Internet Explorer fix two weeks early
Emergency patch for zero-day vulnerability in IE6 and IE7.
Got a news tip for our journalists? Share it with us anonymously here.
Sponsored Whitepapers

See everything. Do more.

Lindentech Secures Digital Identity with Zero Trust and Microsoft Entra

Diamond IT Delivers GRC Transformation with Microsoft Purview

Linktech Powers Energy Trader’s Essential Eight Compliance in Just Eight Weeks

Byte Delivers Future-Ready IT: Transforming Endpoint Security and Productivity with a Cloud-First Strategy