On Sun, 24 Sep 2006, Bill Stout wrote: > http://sunbeltblog.blogspot.com/2006/09/seen-in-wild-zero-day-exploit-be > ing.html > "This exploit can be mitigated by turning off Javascripting. > > Update: Turning off Javascripting is no longer a valid mitigation. A > valid mitigation is unregistering the VML dll. " There is, of course, the ZERT (Zeroday Emergency Response Team) patch, available to those who choose to use it. Along with source code, testing methodology, etc. Naturally a vendor patch is BETTER, this is merely an alternative that can be used, right now, by those who choose to do so. http://www.eweek.com/article2/0,1895,2019162,00.asp http://isotf.org/zert/ Richard wrote an interesting blog entry on it: http://taosecurity.blogspot.com/2006/09/zert-evolution.html > > Bill Stout Gadi.
