eWeek: NOV 4^th, Serious IE Hole Opens PCs Up To Attacks

…Users could be attacked via a malicious Web page viewed in an affected version of IE or possibly through an HTML e-mail viewed in an application such as Outlook, Outlook Express, AOL or Lotus Notes that relies on the WebBrowser ActiveX control, according to researchers.
The bug has been confirmed in IE 6.0 on Windows XP with SP1 and all patches installed, as well as the same browser on a fully patched Windows 2000, according to an advisory from security firm Secunia. Microsoft Corp. has not yet released a patch.
Windows XP systems running Service Pack 2 do not appear to be affected, researchers said. Apart from installing SP2, system administrators can lessen the danger of an attack by disabling active scripting, avoiding unsolicited links that may lead to a malicious Web page and rendering e-mails in plain text, US-CERT said. Updated anti-virus programs may also be able to prevent some exploit attempts…