Workaround for stopping MS2003-030 exploitation via HTML?

["Johnson, Jeff FOR:EX" <Jeff.S.Johnson () gems1 gov bc ca>]

CERT recently issued an advisory about this vulnerability (CA-2003-18,
http://www.cert.org/advisories/CA-2003-18.html) that said that setting the
Internet Explorer 'Run ActiveX Controls' security setting to disable in
appropriate IE security zones would prevent exploitation of this in web
pages and HTML-format email. This sort of makes sense, since media player
can be used as an ActiveX control.

Can anyone confirm that this is really true, though?

Jeff Johnson
Technical Development Analyst, MoF IMG
Jeff.S.Johnson () gems1 gov bc ca
(250) 356-6968