New Active-X Vulnerability Discovered

A newly discovered vulnerability in many versions of Microsoft OS could leave you vulnerable to DoS.


You Can't Detect What You Can't See: Illuminating the Entire Kill Chain

On-Demand Webinar

Microsoft Thursday said that a new flaw discovered in Windows could allow a hacker to conduct a denial of service (define) attack on your computer.

The vulnerability comes from an ActiveX control known as the Certificate Enrollment Control, which allows web-based certificate enrollments. By design, this type of control should be able to install new certificates, but should never be able to access certificates that are already on the user's system. The control contains a flaw that could enable a web page, through a complex process, to invoke the control in a way that would delete certificates on a user's system.

An attacker who successfully exploited the vulnerability could corrupt trusted root certificates, EFS encryption certificates, email signing certificates, and any other certificates on the system, thereby preventing the user from using these features.

According to Microsoft, an attack could be carried out through either of two scenarios. The attacker could create a web page that exploits the vulnerability, and host it on a web site in order to attack users who visited the site or the attacker could send the page as an HTML mail in order to attack the recipient.

Security firm @stake, warns that since the Microsoft Terminal Server ActiveX client is signed by Microsoft and marked safe, there is no warning with the default Internet Explorer security settings if you have previously selected to trust all controls signed by Microsoft. In its report on the vulnerability, the company reiterates that users should not trust any ActiveX components from an unknown source, as a malicious site could use an old vulnerable version of the ActiveX control even after the patched ActiveX component is available from Microsoft. If users install the latest vendor cumulative patch for Internet Explorer this problem is eliminated.

The vulnerability affects Windows 98, 98(2E), NT4.0, Millennium, 2000 and XP. A cumulative patch will be available later today, which also addresses a similar, but less serious vulnerability discovered in the SmartCard Enrollment control in Windows 2000 XP. For those that want to download the patch immediately, click on the your system's version of Windows:

Customers who operate web sites that use the Certificate Enrollment Control will need to make minor revisions to their web applications in order to use the new control. A patch for operators sets the "Kill Bit" on the original version of the control, and provides a new control.

0 Comments (click to add your comment)
Comment and Contribute


(Maximum characters: 1200). You have characters left.



IT Management Daily
Don't miss an article. Subscribe to our newsletter below.

By submitting your information, you agree that datamation.com may send you Datamation offers via email, phone and text message, as well as email offers about other products and services that Datamation believes may be of interest to you. Datamation will process your information in accordance with the Quinstreet Privacy Policy.