An extremely critical exploit of IE6 "createTextRange()" Code Execution" vulnerability is now in the wild. SANS Internet Storm Center has raised the threat condition to Yellow and Secunia is labeling this "Extremely Critical", their highest threat rating. No patch is currently available so either be extremely careful where you surf or switch browsers to Firefox or Opera.

You can read more at NIST.org. Please return here to post comments.

Is there a reason you choose not to link to the SANS report directly? I do not question if you quoted acturately, it would be nice to have the full report and the secondary information they list with it.
While no biggie the complete article is very informative...

http://www.sans.org/top20/#w2

The article I linked to contained 4 different links (SANS, Secunia, MS, and CNet) with the thought that this article would get updated as more information came out. Its just easier to make all the changes in one place.

The link you provided does tell people how to turn off active scripting and ActiveX controls. Even MS is recommending people turn off ActiveX to mitigate for this exploit. I just keep asking myself what reasons are left to keep using Internet Explorer.

SANS has lowered the threat condition back to Green. But their reason why sounds like they just wanted everyone's stress level to go down for the weekend.

But then they say:

So the problem is only getting worse so you can't actually relax. They should have just left it at yellow.

Windows Updates
The only reason I can think of.

LOL!!!!

That and certain software bundles which refuse to install unless you have IE . I got caught today with a DVD burner package which would not install without IE 5.5 or higher being present.

Well, there is always this for windows update run from Firefox: http://windowsupdate.62nds.com/

Another alternative is to install the IE Tab add-on extension for Firefox, you can perform windows update checks from there as well as perform online scans that normally require IE.

Install the Add-on from here: https://addons.mozilla.org/extensions/morei...ication=firefox

More news today: Internet Explorer exploits in the wild

According to this blog at the Washington Post, over 200 sites have been infected with code:
http://blog.washingtonpost.com/securityfix...plorer_f_1.html

Regards,
John

And to make matters worse this vulnerability is now actively being exploited through email attachments. Its recommended to treat all mail attachments with .HTA, .HTM, and .HTML extensions as suspect until this matter is resolved. See SANS.org advisory.

Third party offers temporary IE fix

NOTE:

All members should be advised that you use third-party "fixes" at your own risk.
As of this writing the code to the fix has not been made public, and has not been examined by independent experts. While this could change at any time, it would not mitigate a cautious approached to installing any third-party security fixes.
Most users would be better off using the work-arounds suggested, such as using an alternate browser and disabling (even 'though a pain) active X scripting in IE, and reading all E-mails in "plain text" mode.
Regards,
John

jgweed is correct.

The article clearly quotes a Microsoft's Security Response Center spokesman as stating "Microsoft doesn't recommend installing eEye's fix."

Microsoft tests fix for IE bug as exploits appear

websensesecuritylabs.com/alerts

Optimized IE Exploit Speeds Up Infection

I already posted this in the pinned topic. I'm posting here as well for those following this thread to ensure everyone is informed.

On 11 April 2006 Microsoft is planning to release:

• Four Microsoft Security Bulletins affecting Microsoft Windows. One of the updates will be a cumulative Internet Explorer update that addresses the publicly known "CreateTextRange" vulnerability.

See Microsoft Security Bulletin Advance Notification

Thanks for the update, quietman7.