In my last post on Microsoft's patch schedule I noted with surprise that Microsoft apparently didn't have any vulnerabilities it felt were worth fixing for March. Maybe that wasn't totally true, as one week prior to the April scheduled patch an out-of-band patch for a GDI vulnerability (MS07-017) was released. We at ByteCrusher Labs recommend all of our customers keep up-to-date with all Microsoft operating system and application security patches.
But just in case they don't issue a needed patch until AFTER it is being actively and publicly exploited, as appears to be the case here, we also recommend everyone have some sort of non-signature-based, alternative security software such as WindowZones to help protect them from the unknown unknowns.
We've verified through independent testing that using WindowZones to run your browser in the Safe Zone will protect you against administrative exploits of this newly public Windows GDI vulnerability. Don't let any exploits, but particularly ANI exploits, get you down.
-AllenN
