Security firm eEye Digital Security has released a temporary fix to protect Windows users against an unpatched vulnerability in Internet Explorer.

The critical vulnerability, which involves the way IE handles HTML Objects, affects even fully patched Windows XP systems. Exploits allow hackers to commandeer vulnerable machines by tricking surfers into visiting websites containing malicious code.

"Users can protect themselves by manually making configuration changes, but eEye realises that not all organisations can take those steps. As a result, organisations should only install this patch if they are not able to disable Active Scripting as a means of mitigation," eEye cofounder and chief hacking officer Marc Maiffret said.

eEye stresses that its workaround shouldn't be seen as a substitute for a fully tested patch, but will provide "immediate protection in lieu of an available fix". In fact, eEye has engineered the patch to automatically remove itself when Microsoft's official patch comes through," Maiffret added. ®

Related stories

• Infosec blog Cybercops and zero day vulns (24 April 2006)
• MS releases long-awaited IE fix (12 April 2006)
• Critical IE fix due Tuesday (7 April 2006)
• Hackers use BBC story to bait IE exploit (31 March 2006)
• Patches released for zero-day IE threat (29 March 2006)
• 'Critical' IE bug threatens PC users (27 March 2006)
• Seven patches for St Valentine's patch Tuesday (15 February 2006)
• Windows users waiting for serious fix (3 January 2006)
• World+dog scrambles to fight Windows flaw (3 January 2006)
• Trojan alert over unpatched Windows flaw (29 December 2005)
• MS releases IE überpatch (14 December 2005)
• Exploit for unpatched IE vuln fuels hacker fears (19 August 2005)