In Windows Server 2003 ONLY, the Enhanced Security Configuration feature can successfully mitigate this attack via IE from the Internet Zone. If ESC has been disabled/modified, Windows Server 2003 can be exploited via IE.

Additionally, the default behavior of Microsoft Outlook and Outlook Express is to open HTML e-mail messages in the Restricted sites zone. If these settings have been modified, the exploit may execute successfully via a maliciously crafted HTML e-mail message.

Microsoft recommends setting the killbits for this particular ActiveX control. They have released a tool that will do this automatically. It can be downloaded at http://go.microsoft.com/?linkid=9672398

Users should also be encouraged to switch to a browser other than Internet Explorer for everyday browsing purposes.