We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Zero-day attack concern for Internet Explorer users

PC securityMicrosoft has warned of a serious security vulnerability in a Spreadsheet ActiveX control that could allow for a drive-by-download attack against vulnerable PCs.

The news means there are now two critical, unpatched holes involving flawed ActiveX controls (the first was disclosed last week) that could make Internet Explorer users vulnerable to drive-by-download attacks if they simply view a poisoned web page. Microsoft's advisory doesn't specify whether IE 8.0 might mitigate the new threat, but it does list these software components as installing the flawed ActiveX:

  • Microsoft Office XP Service Pack 3
  • Microsoft Office 2003 Service Pack 3
  • Microsoft Office XP Web Components Service Pack 3
  • Microsoft Office 2003 Web Components Service Pack 3
  • Microsoft Office 2003 Web Components for the 2007 Microsoft Office system Service Pack 1
  • Microsoft Internet Security and Acceleration Server 2004 Standard Edition Service Pack 3
  • Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition Service Pack 3
  • Microsoft Internet Security and Acceleration Server 2006
  • Internet Security and Acceleration Server 2006 Supportability Update
  • Microsoft Internet Security and Acceleration Server 2006 Service Pack 1
  • Microsoft Office Small Business Accounting 2006

Office 2000 Service Pack 3 and Office 2007 are not at risk by themselves, according to the advisory, but Office 2007 users could be vulnerable if they have installed the Office 2003 Web Components package listed above.

While Microsoft will be releasing its monthly patch batch tomorrow, it's highly unlikely that it will include a fix for this flaw. So if you have (or think you might have) any of the affected software installed on your PC, head to Microsoft's fix-it page and click the Fix it button under 'Enable Workaround'. Then run the downloaded .msi file to disable the flawed add-on while we wait for a real fix from Microsoft.

And if you haven't yet applied the similar Fix-it solution for last week's equally dangerous ActiveX zero-day hole, you'll find the link on this Fix-it page.

See also:

Internet Explorer 8.0 review

PC security alerts and advice

PC World

IDG UK Sites

The 30 best TV shows on Netflix UK: Our pick of the best programmes you can watch right now

IDG UK Sites

Nostalgia time: Top 10 best selling mobile phones in history

IDG UK Sites

VFX Emmy: Game of Thrones work garners gong for Rodeo FX

IDG UK Sites

Apple 13-inch MacBook Pro with Retina review (2.6GHz, 128GB, mid-2014)