US-CERT Technical Cyber Security Alert TA09-187A -- Microsoft Video ActiveX Control Vulnerability




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


National Cyber Alert System

Technical Cyber Security Alert TA09-187A


Microsoft Video ActiveX Control Vulnerability

Original release date: July 06, 2009
Last revised: --
Source: US-CERT


Systems Affected

* Microsoft Windows XP
* Microsoft Windows Server 2003


Overview

An unpatched vulnerability in the Microsoft Video ActiveX control
is being used in attacks.


I. Description

Microsoft has released Security Advisory (972890) to describe
attacks on a vulnerability in the Microsoft Video ActiveX control.
Because no fix is currently available for this vulnerability,
please see the Security Advisory and US-CERT Vulnerability Note
VU#180513 for workarounds.


II. Impact

A remote, unauthenticated attacker could execute arbitrary code
with the privileges of the victim user.


III. Solution

Apply workarounds

Microsoft has provided workarounds for this vulnerability in
Security Advisory (972890). Additional details and workarounds are
provided in US-CERT Vulnerability Note VU#180513.

The most effective workaround for this vulnerability is to set kill
bits for the Microsoft Video ActiveX control, as outlined in the
documents noted above. Other workarounds include disabling
ActiveX, as specified in the Securing Your Web Browser document,
and upgrading to Internet Explorer 7 or later, which can help
mitigate the vulnerability with its ActiveX opt-in feature.


IV. References

* US-CERT Vulnerability Note VU#180513 -
<http://www.kb.cert.org/vuls/id/180513>

* Microsoft Security Advisory (972890) -
<http://www.microsoft.com/technet/security/advisory/972890.mspx>

* Securing Your Web Browser -
<http://www.us-cert.gov/reading_room/securing_browser/>

____________________________________________________________________

The most recent version of this document can be found at:

<http://www.us-cert.gov/cas/techalerts/TA09-187A.html>
____________________________________________________________________

Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@xxxxxxxx> with "TA09-187A Feedback VU#180513" in
the subject.
____________________________________________________________________

For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________

Produced 2009 by US-CERT, a government organization.

Terms of use:

<http://www.us-cert.gov/legal.html>
____________________________________________________________________

Revision History

July 06, 2009: Initial release


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iQEVAwUBSlJnyXIHljM+H4irAQJuxAgAmY94zTKwprhMdsYJ8/6z5Td2APg0Keyt
wR/ihBM423Lp9NXRNkZQkxk+Fv+whjShJnB6yDBWpDDe9RNlguuAzqGd3L6q7B54
TOjfGcn1b61n6DMrKjx20bJvOOrMT3JHgePXwWjF8iDo8AnHYdv+ARwt2KvyRbxg
Ve4wWRB6tkJtX8cqJwjvYjW2ayo9tjV9sV5+qUSdyhHOvT6jSc/C8JBF4NzE0jx0
R0vfXhfA1QIqz9XjdpdWG7iyAXxa51k92XTHa3ohIQGWDI2qzN8RFHh9xUuCVZWx
UgoRdnc1oKc7lsw6Po9oW4PPQzGVxbzTAqP94eWN0zSTIpw4u75pQA==
=fhVj
-----END PGP SIGNATURE-----



Relevant Pages

  • US-CERT Technical Cyber Security Alert TA09-187A -- Microsoft Video ActiveX Control
    ... Technical Cyber Security Alert TA09-187A ... Microsoft Video ActiveX Control Vulnerability ...
    (comp.security.announce)
  • SecurityFocus Microsoft Newsletter #165
    ... Tenable Security ... distribute, manage, and communicate vulnerability and intrusion detection ... Microsoft Internet Explorer MHTML Forced File Execution Vuln... ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter #174
    ... This issue sponsored by: Tenable Network Security ... the worlds only 100% passive vulnerability ... MICROSOFT VULNERABILITY SUMMARY ... Novell Netware Enterprise Web Server Multiple Vulnerabilitie... ...
    (Focus-Microsoft)
  • [NT] Cumulative Security Update for Internet Explorer (MS04-038)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... CSS Heap Memory Corruption Vulnerability, ... Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6 ...
    (Securiteam)
  • SecurityFocus Microsoft Newsletter #171
    ... Better Management for Network Security ... GoodTech Telnet Server Remote Denial Of Service Vulnerabilit... ... ASPApp PortalAPP Remote User Database Access Vulnerability ...
    (Focus-Microsoft)