http://sg.news.yahoo.com/ap/20081216/tbs-tec-internet-explorer-security-f8250da.html
REDMOND, Wash. - Microsoft Corp. is taking the unusual
step of issuing an emergency fix for a security hole in its
Internet Explorer software that has exposed millions of users to
having their computers taken over by hackers.<!--Vendor: Yahoo,
Format: Standard -->
The "zero-day" vulnerability, which came to light last
week, allows criminals to take over victims' machines simply by
steering them to infected Web sites; users don't have to download
anything for their computers to get infected, which makes the flaw
in Internet Explorer's programming code so dangerous. Internet
Explorer is the world's most widely used Web browser.
Microsoft said it plans to ship a security update, rated
"critical," for the browser on Wednesday. People with the Windows
Update feature activated on their computers will get the patch
automatically.
Thousands of Web sites already have been compromised by
criminals looking to exploit the flaw. The bad guys have loaded
malicious code onto those sites that automatically infect visitors'
machines if they're using Internet Explorer and haven't employed a
complicated series of workarounds that Microsoft has suggested.
Microsoft said it has seen attacks targeting the flaw only in
Internet Explorer 7, the most widely used version, but has
cautioned that all other current editions of the browser are
vulnerable.
Microsoft rarely issues security fixes for its software outside
of its regular monthly updates. The company last did it in October,
and a year and half before that.
___
On the Net:
Microsoft's security advisory:
http://www.microsoft.com/technet/security/advisory/961051.mspx