Critical Out of Cycle Update for Internet Explorer

What Is It?

Today, Microsoft released an out of cycle update for all supported versions of Internet Explorer for Windows, to fix an error that could permit a criminal to take over your computer. Microsoft took this unusual step because exploit code was made public the day after the last monthly update cycle, and that code is being actively employed to turn users' machines into remote controlled zombie computers.

Worse yet, there are reports that exploit code has made its way into legitimate Web sites that you would expect to be trustworthy and secure.

Microsoft Security Bulletin MS08-078 covers updates to the following versions of Internet Explorer.

• Version 5.01, Service Pack 4, when installed on Windows 2000, Service Pack 4.
• Version 6, Service Pack 1, when installed on the the following operating systems:
• Windows 2000, Service Pack 4.
• Windows XP, Service Pack 2.
• Windows XP, Service Pack 3.
• Windows XP, x64 edition, Service Pack 2.
• Windows Server 2003, all editions, Service Pack 1.
• Windows Server 2003, all editions, Service Pack 2.
• Version 7, when installed on the the following operating systems:
• Windows XP, Service Pack 2.
• Windows XP, Service Pack 3.
• Windows XP, x64 edition, Service Pack 2.
• Windows Server 2003, all editions, Service Pack 1.
• Windows Server 2003, all editions, Service Pack 2.
• Windows Vista, all editions.
• Windows Vista, all editions, Service Pack 1.
• Windows Server 2008, all editions.
• Windows Internet Explorer 8, Beta 2. If you are evaluating this latest edition, you should download and install the latest update from the beta test Web site.

What Should You Do?

If you have Automatic Update enabled, you may have already received this update. My machine had an update awaiting permission to install when I arrived at my office at about 1:30 PM today. Unless you are certain that the update has already arrived, you should visit the Microsoft Update Web site, at http://update.microsoft.com/, and install the update.

If you have not yet installed the cumulative update for Internet Explorer that was distributed last week, you must install that update before you install this one. If so, both updates should appear on the list of updates offered by the Windows Update service.

References

• http://www.microsoft.com/technet/security/bulletin/ms08-078.mspx, Microsoft Security Bulletin MS08-078 - Critical: Security Update for Internet Explorer (960714), is the announcement covering this critical out of cycle security update for all supported versions of Microsoft Internet Explorer for Windows.
• http://update.microsoft.com/ is the Microsoft Update Web site.
• http://www.microsoft.com/technet/security/bulletin/ms08-073.mspx, Microsoft Security Bulletin MS08-073 - Critical: Cumulative Security Update for Internet Explorer (958215), is the security bulletin that covers the most recent cumulative update for Internet Explorer, released last week, on 9 December 2008.
• http://www.microsoft.com/technet/security/bulletin/ms08-dec.mspx, Microsoft Security Bulletin Summary for December 2008, Published: December 9, 2008, most recently Updated: December 17, 2008, Version: 3.0.

David Gray, MBA, Chief Wizard WizardWrx – Making computer magic since 1985
	V: +1 (817) 812-3041 TZ: USA Central www.wizardwrx.com	4835 North O'Connor Road Suite 200 Irving, TX 75062-2742 USA
Tell me what you need, and I’ll conjure it.