Microsoft released a security advisory regarding the 0-day we reported on earlier.

Timeline:

• Aug 28th: 1st exploit released publicly
• Aug 29th: CVE-2006-4446 assigned
  
• Sept 13th: 2nd exploit released publicly
  
• Sept 13th: CVE-2006-4777 assigned
• Sept 14th: Microsoft Security Advisory (925444) released

Workarounds:

• Use an alternate browser (see also diversity)
• Disable ActiveX scripting in MSIE
• Modify the ACL on daxctle.ocx to remove rights to use it
  
• Set the KillBit for "{D7A7D7C3-D47F-11D0-89D3-00A0C90833E6}"
• Make MSIE prompt before executing ActiveX

Please note that windowsupdate needs an ActiveX enabled browser, but you can do that with settings to the security zones and trusting Microsoft.

Please not that the outlook family is affected as well but that the default settings will typically mitigate much of the risk. That is as long as nobody or nothing has modified the settings ...

With thanks to the readers writing in to remind us and keep the details right.

Update #1

Snort VRT Rule #8053 catches this vulnerability.  The rules are available at http://www.snort.org/rules.  Sourcefire released rules for this vulnerability on September 1st.

--
Swa Frantzen -- Section 66