Hi this is Christopher Budd,
I wanted to give you a quick update on a couple of new things today related to Microsoft Security Advisory 961051.
We’ve made another revision to the advisory today. Our research teams are working around the clock to help identify better, more effective workarounds to give customers more options to evaluate and we’ve updated the advisory with the latest information from their research.
We’ve also posted some additional details and information on the Security Vulnerability Research and Defense blog. This includes a Vista-specific workaround as well as additional information to help your analysis of the different workaround options.
Based on customer questions, we’ve made changes in the advisory to help make clearer that each of the multiple workarounds outlined provides effective protections against the known attacks. Applying any one of these workarounds by themselves effective, however, we are providing multiple workarounds in the advisory to give you as many options to evaluate for your organization as possible.
That said, the recommendation that we made yesterday still holds: evaluate applying a combination of workarounds that both sets the Internet Explorer security settings to High and blocks access to OLEDB32.dll. We have outlined three different options for blocking access to OLEDB32.dll: any one of them is sufficient to use in combination with setting the Internet Explorer security settings to High to provide protections. Our research has shown that this combination provides the most effective protections against the current attacks and possible future attacks.
Our work continues around developing a security update as well as our ongoing monitoring of the threat environment. Our teams are continuing their research into workarounds and as we confirm new information, we will continue to post updates in the security advisory or the MSRC weblogs.
Christopher
*This posting is provided “AS IS” with no warranties, and confers no rights.*