Microsoft to deliver Internet Explorer fix two weeks early

Microsoft plans to release an emergency fix tonight for a zero-day vulnerability affecting Internet Explorer versions 6 and 7, the software giant announced.

The out-of-band patch will resolve the bug, which was disclosed earlier this month on the same day Microsoft released its March security updates. The vulnerability currently is being exploited in targeted attacks but the issue is not present in IE8, the newest browser version.

"We recommend that customers install the update as soon as it is available," Jerry Bryant, group manager of response communications at Microsoft, said in a blog post.

As users await the fix, the vulnerability can be mitigated through IE Protected Mode, which is turned on by default in IE7 running on Vista. In addition, Microsoft is offering an automated workaround to mitigate the flaw. This "Fix It" solution mitigates the flaw "by disabling the peer factory class through the modification of a registry key," the company said.

Releasing an out-of-cycle patch is rare but not unheard of for Microsoft, especially with the company's next scheduled patch release not until April 13.

In January, Microsoft closed another IE hole, which was leveraged in the Google-China attacks, with an emergency fix.

See original article on scmagazineus.com