New Security Advisory 1

[smah]

Microsoft Security Advisory (972890)
Vulnerability in Microsoft Video ActiveX Control Could Allow Remote Code Execution

http://www.microsoft.com/technet/security/advisory/972890.mspx

According to the the document, there are already "attacks attempting to exploit this vulnerability" and that "there are no by-design uses for this ActiveX Control in Internet Explorer". The way that I read it, it also seems to indicate, that this vulnerability could even be exploited by content in a banner ad on a legitimate website. Users running as administrators are most vulnerable.

There's a fix tool in KB972890 that is an MSI which could easily be deployed by script or group policy.

 

[linney]

Thank you for bringing this to our notice.