I have a 'security' mailing list to which I send Microsoft patch details [since they mostly use the Windows/IE/Office combination]. Here's a sample:

* * *
Subject: Fix for critical flaw in (Windows) Internet Explorer

Greetings,

Microsoft have released a fixed for a critical flaw in their Internet Explorer for Windows software.

DETAILS

The flaw is *currently being exploited*, and there are documented instances of computers being overtaken by malicious web pages written to take advantage of this issue: http://news.zdnet.co.uk/0,39020330,39116876,00.htm


RECOMMENDATION

I recommend you identify the version of Internet Explorer you are using from the list below, and then download and install the corresponding fix:

Internet Explorer 6 Service Pack 1
All versions of Windows
http://download.microsoft.com/download/A/B/B/ABB44141-F5D9-4
BCA-B85C-9CDBEE344F14/q828750.exe

Internet Explorer 6
Windows XP *only*
http://download.microsoft.com/download/A/4/E/A4ECF739-A31F-4
A7A-8CA2-C676B4A9D1B4/q828750.exe

Internet Explorer 5.5 Service Pack 2
All versions of Windows
http://download.microsoft.com/download/5/F/D/5FD22C56-00FA-4
1AB-8067-D9360C432C24/q828750.exe


FURTHER INFORMATION

http://www.microsoft.com/security/security_bulletins/ms03-04
0.asp

* * *

I figure the important elements of this are:

(1) Simplicity. No jargon.

(2) Conciseness. No technical details which end users probably won't understand and certainly aren't in the faintest bit interested in, not withstanding...

(3) Illustrative. Calling it a 'vulnerability' only means something to those who are already security-minded. Give them an example of how and what it can do: delete files? compromise passwords? take control of their PC?

(4) Specific. Give solutions, not issues.

(5) Informative. Provide a link for further information if anyone is interested (but remember, chances are no-one will be!)

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/193/23334#23334