CERT recently issued an advisory about this vulnerability (CA-2003-18, http://www.cert.org/advisories/CA-2003-18.html) that said that setting the Internet Explorer 'Run ActiveX Controls' security setting to disable in appropriate IE security zones would prevent exploitation of this in web pages and HTML-format email. This sort of makes sense, since media player can be used as an ActiveX control. Can anyone confirm that this is really true, though? Jeff Johnson Technical Development Analyst, MoF IMG Jeff.S.Johnson@gems1.gov.bc.ca (250) 356-6968
