Microsoft has confirmed a new, unpatched vulnerability in Internet Explorer, and promised to fix the problem with an update on Oct. 10. In a security advisory posted on its support site, Microsoft admitted that an ActiveX control -- WebViewFolderIcon, also called "Web View" -- exposes a vulnerability in the Windows Shell that can be exploited by attackers to hijack PCs.
The likely attack vector, said Microsoft, would be the now-standard malicious Web site; victims would have to be drawn to the site with e-mailed or IMed lures, or surf to it on their own to be attacked. All currently-support editions of Windows are at risk, including Windows 2000, XP (SP1 and SP2), and Windows Server.
Thursday, security vendors and organizations, including Symantec and US-CERT, warned that exploit code had been released. The bug was originally reported in July as part of HD Moore's "Month of Browser Bugs" project where he identified dozens of flaws in IE and other Web browsers. The vast majority of those vulnerabilities remain unpatched.
Link: Microsoft Security Advisory (926043)
View: Full Article @ InformationWeek
The likely attack vector, said Microsoft, would be the now-standard malicious Web site; victims would have to be drawn to the site with e-mailed or IMed lures, or surf to it on their own to be attacked. All currently-support editions of Windows are at risk, including Windows 2000, XP (SP1 and SP2), and Windows Server.
Thursday, security vendors and organizations, including Symantec and US-CERT, warned that exploit code had been released. The bug was originally reported in July as part of HD Moore's "Month of Browser Bugs" project where he identified dozens of flaws in IE and other Web browsers. The vast majority of those vulnerabilities remain unpatched.
Link: Microsoft Security Advisory (926043) View: Full Article @ InformationWeek
plus activex in general is a mistake
plus activex in general is a mistake
Maybe so but more and more softwrae is going online based and unfortunalt ytjhats always going tobebcome a security issue it doesent matter werther you write your software in ActiveX or Java there will always be security risks maybe we should disable flash/java/javascript and even images in our webbrowers and go back to usenet incase we get hacked :/
The more popular Firefox gets the more of these vunrabilities are being found also activex is only one way of getting into a system.
regsvr32 -u "%ProgramFiles%Common FilesMicrosoft SharedVGXvgx.dll
Becasue ActiveX depends on MSIE to work, smart guy.
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.