According to Microsoft Security Advisory – 973472, a zero-day hole in Office Web Components ActiveX Controls could allow an attacker to execute malicious code remotely. This happens on Internet Explorer that has the ActiveX Control enabled.
The ActiveX is used to display and publish spreadsheets, charts and databases to websites. There is no patch yet issued for this hole. However, Microsoft recommends certain manual steps to prevent the attack.
Microsoft recommends defaults settings of IE in Windows Server 2003 and Windows Server 2008 as it will prevent the an IE user on such servers from downloading such malicious contents.
Users of Microsoft Outlook and Outlook Express are safe if they are operated in the Restricted Sites Zone.
The web based attacked is not possible unless an IE user is forced to use a website infected with the malicious content. So beware of spams and phishing emails.
Once compromised, the IE user machine provides local admin rights to the remote attacker. Users with few local admin rights on the computer will have low impact.