Stop Using Internet Explorer 7 (For Now), Or Deploy Workarounds

There is an unpatched vulnerability for Internet Explorer 7 being actively exploited in the wild. The details are public, so any bad guy can take advantage of this. It's a heap overflow in the XML parser, for you geeks out there. It affects all current versions of Windows.

Microsoft issued an advisory with workarounds that prevent exploitation:

1. Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting in these zones.
2. Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.
3. Enable DEP for Internet Explorer 7.
4. Use ACL to disable OLEDB32.DLL.
5. Unregister OLEDB32.DLL.
6. Disable Data Binding support in Internet Explorer 8.

—Rich