There's exploit code circulating that can be used to target certain versions of Internet Explorer, Microsoft says it's working on a fix.In Security Advisory 977981 Microsoft acknowledged Internet Explorer 6 on Microsoft Windows 2000 Service Pack 4, and Internet Explorer 6 and Internet Explorer 7 on supported editions of Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 is vulnerable to a remote code execution attack.
Fortunately, Microsoft Internet Explorer 5.01 Service Pack 4 and Internet Explorer 8 on all supported versions of Microsoft Windows are not affected.
The flaw makes it possible to exploit how Internet Explorer handles cascading style sheet (CSS) information. And, currently, while the vulnerability theoretically makes it possible for attackers to run attack code on victim's machines, it's not yet an easy attack, according to this post from security firm Symantec:
With all of the online transactions expected to take place during the next few weeks, attackers will be angling for any edge they can get to infiltrate systems and grab credit card data. So expect fully functional exploit code to come quickly.