Microsoft says only a few applications use the component vulnerable to a bug exposed last week.
Microsoft on Monday continued to downplay the potential impact of last week's "zero-day" vulnerability in Internet Explorer, now by stressing the limited number of applications which use the flawed component.
According to a revamped security advisory on the Microsoft Web site, the affected COM object, Msdds.dll, is not added to a Windows system by default. It's actually only present when Microsoft Visual Studio 2002 and some versions of Microsoft Office applications have been installed.
"Customers who use the initial release of Microsoft Visual Studio 2002 are at risk from this vulnerability and are encouraged to apply Microsoft Visual Studio 2002 Service Pack 1," Microsoft stated in the updated advisory.
Other at-risk installations are Microsoft Office XP SP3 and Microsoft Access 2002 SP3.
Because Visual Studio 2002 is a development tool, it's unlikely run-of-the-mill business or home users will be vulnerable to an exploit of this Internet Explorer vulnerability. The bug in IE is due to a memory error caused when the browser calls on the Msdds.dll file as an ActiveX control. A successful exploit, which would be posted on a malicious Web site, could give the attacker complete control of the PC without any user interaction.
The revised advisory also offers a number of workarounds that users and enterprises can apply, including setting IE security to "high" and disabling the Msdds.dll file from running in IE.
Last week, the SANS Internet Storm Center posted a small free-of-charge utility that automatically "patched" the flaw by modifying the Windows registry.
The Business of Going DigitalDigital business isn't about changing code; it's about changing what legacy sales, distribution, customer service, and product groups do in the new digital age. It's about bringing big data analytics, mobile, social, marketing automation, cloud computing, and the app economy together to launch new products and services. We're seeing new titles in this digital revolution, new responsibilities, new business models, and major shifts in technology spending.
What The Business Really Thinks Of IT: 3 Hard TruthsThey say perception is reality. If so, many in-house IT departments have reason to worry. InformationWeek's IT Perception Survey seeks to quantify how IT thinks it's doing versus how the business views IT's performance in delivering services - and, more important, powering innovation. The news isn't great.