< Stupidity always threatens Litigation | McAfee VirusScan Enterprise User Interface Protection Bypass Flaw >
It seems out generic timeline for Microsoft 0days goes along the lines of:
- Flaw is found.
- Microsoft says it isn't being widely exploited and "safe browsing habits" will save you1.
- The threat grows in the wild on porn and pirate sites.
- Microsoft re-iterates the minimal exploitation.
- The threat continues to grow on 'safe' sites.
The point here is that a threat is going to continue to grow as long as there isn't effective mitigation, like a patch. When Microsoft says there is only minimal exploitation is exactly the time they should be rushing out a fix. Even if the threat is growing slowly, this is not an indication by itself that it won't be used in an attack on a multiple site advertiser or the like. This isn't even taking into account all the fun you can have with a targeted attack; we are still dealing with preventing mass exploitation.
As an aside: IE 0day "in the wild" threat growth:
1They also tell you to turn the affected component off. But this never really helps given that most browsing becomes useless.
