Microsoft has confirmed reports that a zero-day vulnerability in its Internet Explorer Web browser is being actively attacked in the wild. While Microsoft works diligently to crank out a patch, it’s important for businesses and consumers to understand the threat, and the steps that can be taken to avoid compromise while you wait.
Microsoft has
published a security advisory acknowledging the threat. According to Microsoft, the zero-day exploit affects Internet Explorer 7, 8, 9. Internet Explorer 10 is not impacted, but it’s not completely safe because it remains vulnerable to
flaws in the embedded Adobe Flash.
The Microsoft advisory includes some tips that can be used to defend against this threat pending a patch for the underlying flaw. Microsoft recommends that customers use the
Enhanced Mitigation Experience Toolkit (EMET) to implement mitigations that can prevent the zero-day exploit from working. In addition, Microsoft advises customers to set the Internet and local intranet security zone in Internet Explorer to “High” to block ActiveX controls and Active Scripting from running, or at least configure it to prompt before executing.
