The fix, available here, was bumped up ahead of the next scheduled security fix release date on Oct. 10 because of the severity of the problem.
Microsoft’s security division said users could come under attack just by visiting a website that had been manipulated to take advantage of the flaw. Attackers would be able to take complete control of a user's computer and access to all data.
Security research organization SANS Institute said it appears that several thousand websites have already been manipulated to launch such attacks. The attack also seems to be spreading via email.
Johannes Ullrich, chief technology officer with SANS, faulted Microsoft for not getting a fix out sooner, noting that attacks are already underway, and urged users to get the fix immediately.
“Installing the patch is definitely the way to go,” Ullrich said.
