Microsoft has acknowledging the threat. According to Microsoft, the zero-day exploit affects Internet Explorer 7, 8, 9. Internet Explorer 10 is not impacted, but it's not completely safe because it remains vulnerable to .
The Microsoft advisory includes some tips that can be used to defend against this threat pending a patch for the underlying flaw. Microsoft recommends that customers use the to implement mitigations that can prevent the zero-day exploit from working. In addition, Microsoft advises customers to set the Internet and local intranet security zone in Internet Explorer to "High" to block ActiveX controls and Active Scripting from running, or at least configure it to prompt before executing.
Andrew Storms, director of security operations for , puts the threat in perspective. "If your systems are running IE, you are at risk, but don't panic. The reality is it's just one more zero-day and we've seen an awful lot of them come and go."
However, Storms isn't confident that business customers will appreciate the guidance from Microsoft. "If you set your Internet and local security zones to 'High' as recommended to block ActiveX controls and Active Scripting, there's a very good chance necessary business applications will be adversely affected."
The Metasploit exploit for the Internet Explorer zero-day relies on the presence of Java on the target system. That means that PCs without Java are safe against the Metasploit-based exploits, and that it might be a great time to reevaluate whether your PCs really need to run Java. .