Microsoft Offers Download Workaround For IE Bug

The vulnerability, which first surfaced last week in a security advisory, involves the "Javaprxy.dll" file, which is part of the Microsoft Java Virtual Machine, and handles ActiveX controls. A hacker could exploit the bug to make IE crash or even insert his own code onto the system.

The workaround, which users can download from Microsoft's Download Center, disables Javaprxy.dll by modifying the Windows registry. The same can be done manually, but most users are unfamiliar with that crucial component of the operating system; an error in the registry can make Windows unbootable.

The affected versions of IE include 5.01 SP3 and SP4, 5.5 SP2, 6.0, and 6.0 SP1 on Windows 98, Me, 2000, XP (including the vaunted security update, XP SP2), and Windows Server 2003 (including that OS's recently-released SP1).

A Microsoft spokesperson said that the download would be placed on Windows Update "as soon as possible," and that the update would be included in a future security bulletin. The next scheduled bulletin roll-out is Tuesday, July 12, but Microsoft hasn't committed to adding this fix to that bunch.

Danish security firm Secunia characterized the gaffe as "Extremely critical," the highest rating in its five-step system. Although there's yet no evidence of active attacks on IE based on the vulnerability, U.S.-based security vendor Symantec reported as early as Saturday that exploit code had gone public.

"Comments within the exploit claim that it has been tested on Microsoft Windows XP SP1 and Microsoft Windows XP SP2 systems," Symantec's DeepSight Threat network reported. "The DeepSight Threat Analyst Team was unable to successfully exploit a Microsoft Windows 2000 test system using this exploit, however, minor modifications to the code may allow a successful attack."

Symantec also said it was monitoring port 28876, the port used by the public exploit to target vulnerable PCs, but that "currently, there is no indication of elevated activity targeting this port."

Links to the various downloads -- one for each of the IE editions -- can be found in the updated security advisory.