The official patch will be released mid april during normal release cycle.
It may get pushed fwd so keep an eye on ms.

If u turn off active scripting it will disable java (virtual machine), activex, vbscript and Jscript.
If u want to go down this path then make sure u apply this to ur zones, and have ur corporate sites listed as in the trusted zone.

This flaw actually requires u to visit a site.
The main way of getting hit currently is via spam with embedded links, so a client needs to click the link (user education).

Most antispyware/antivirus will detect the trojan that loads from this attack.
The original posting can be found here:
http://secunia.com/advisories/18680/

Remeber security is all about risk management.
You will need to weigh up if the risk is high enough to suffer a loss of service for ur clients. eg some sites will not work, eg internet banking, e commerce etc.
This loss of business funtion needs to balanced with the chance of it occuring, and the impact of it occuring.... ahh the lovely seesaw.

Regards
Rahvintzu