PatchLink to Release a Fix for VML Exploit to Protect Customers From Zero-Day Threats.

SCOTTSDALE, Ariz. -- As hackers continue to exploit a security vulnerability in Microsoft Internet Explorer, rated as "extremely critical," PatchLink is releasing a PatchLink-authored fix for customers worldwide to protect their networks from VML zero-day threats.

According to PatchLink Vice President of Security Technologies Chris Andrew, the Microsoft IE flaw could be potentially harmful to the IT environment as it can lead to remote execution of a malicious code on a user's system.

Andrew notes: "Zero-day vulnerabilities such as the IE flaw are a rising trend in today's security landscape. With the VML exploit now becoming more widespread, PatchLink has taken immediate action to develop and deliver an automated fix for the zero-day threat for our customers to mitigate risks to their systems until the next Microsoft Patch Tuesday rolls around. This remedy helps our customers to automatically deploy one of the Microsoft-endorsed solutions for this particular exploit, and can be automatically uninstalled once the official vendor patch becomes available."

PatchLink cautions IT professionals to always implement a best practices approach for distributing patches. A wait-and-see approach leaves a network open to attack and also increases the chance of human error. With some planning in conjunction with automated IT security software solutions for patch management and vulnerability remediation, critical security updates can be easily tested and deployed long before a virulent worm or Trojan attacks.

Andrew adds: "As the number of vulnerabilities continue to rise with over 6,700 expected in 2006, IT administrators can expect to see more third-party patches such as the VML patch released by the ZERT group to protect against zero-day outbreaks. However, PatchLink highly recommends organizations take careful measures to ensure the patch is fully endorsed and recognized as the appropriate safe solution by trusted industry organizations such as PatchLink, SANS or CERT before blindly implementing this temporary patch for the MS IE flaw."

For non-PatchLink customers, Andrew recommends using a Microsoft endorsed workaround. In addition:

* Update your antivirus software, and make sure your vendor has protection for it.

* Unregister the vulnerable dll:

-- regsvr32 /u "%ProgramFiles%\Common Files\Microsoft Shared\VGX\vgx.dll"

-- regsvr32 /u "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll"

* Reboot the machine to make sure all in memory copies are gone as well.

* Consider asking your users to stop their usage of MS IE. We know it's hard to break an addiction, but you're using the most targeted browser in the world.

Reregistering a dll (which you might want to do after an official patch is released) is done with the same command as unregistration, but without the "/u".

ABOUT PATCHLINK CORPORATION

PatchLink[R] is the global leader for security patch and vulnerability management solutions, delivering comprehensive, multi-platform assessment and remediation for continuous protection across the enterprise. Offering the most comprehensive platform and application support, PatchLink maintains the largest tested and most up-to-date security patch repository, enabling organizations to accurately assess and remediate vulnerabilities based on established industry best practices. Currently protecting thousands of commercial and government organizations and millions of PCs and servers worldwide, PatchLink effectively eliminates vulnerability risks and enforces security and compliance policies while reducing overall IT costs.

[c]2006 PatchLink Corporation. All rights reserved. PatchLink, the PatchLink logo, and the PatchLink product names and logos are either registered trademarks or trademarks of PatchLink Corporation in the United States. In addition, other company names and products mentioned in this document, if any, may be either registered trademarks or trademarks of their respective owners.

EDITORS NOTE: Chris Andrew or Don Leatham is immediately available for comment.