There is no patch for versions of IE 4 earlier than 4.0 SP2, so users of those versions will need to first upgrade to a newer version. Alternatively, you can protect yourself from the flaw by disabling HTML scripting from within your mail reader. Or, always save attachments to disk and open them from outside the mail reader. Affected mail readers include, but may not be limited to, Outlook Express and Outlook 2000. After applying the patch, you will be requested to reboot.
Details are in the FAQ .
This is somewhat less frightening a prospect than many of the scenarios presented by other recently reported IE exploits, but unwelcome nonetheless. The new patch is identically numbered, and there is no known easy way to tell if your browser has the updated patch. The new patch has the MD5 sum ee43849438f8ab055951b4fa1525c990 and a filesize of 1140256 bytes. To do so, they would have to hand-craft a Java applet designed to exploit the flaw, and you would have to visit the site . Microsoft has released a new version of the software that repairs the flaw, and, if you run IE 4.x or 5.0, it is recommended that you install the patch expeditiously.