SHARE

New Active-X Vulnerability Discovered

Microsoft Thursday said that a new flaw discovered in Windows could allow a hacker to conduct a denial of service (define) attack on your computer. The vulnerability comes from an ActiveX control known as the Certificate Enrollment Control, which allows web-based certificate enrollments. By design, this type of control should be able to install new […]

Written By

Michael Chait

Aug 29, 2002

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

Microsoft Thursday said that a new flaw discovered in
Windows could allow a hacker to conduct a denial of service (define) attack on
your computer.

The vulnerability comes from an ActiveX control known as the Certificate
Enrollment Control, which allows web-based certificate enrollments. By
design, this type of control should be able to install new certificates, but
should never be able to access certificates that are already on the user’s
system. The control contains a flaw that could enable a web page, through a
complex process, to invoke the control in a way that would delete
certificates on a user’s system.

An attacker who successfully exploited the vulnerability could corrupt
trusted root certificates, EFS encryption certificates, email signing
certificates, and any other certificates on the system, thereby preventing
the user from using these features.

According to Microsoft, an attack could be carried out through either of two
scenarios. The attacker could create a web page that exploits the
vulnerability, and host it on a web site in order to attack users who
visited the site or the attacker could send the page as an HTML mail in
order to attack the recipient.

Security firm @stake, warns that since the Microsoft Terminal Server ActiveX
client is signed by Microsoft and marked safe, there is no warning with the
default Internet Explorer security settings if you have previously selected
to trust all controls signed by Microsoft. In its report on the
vulnerability, the company reiterates that users should not trust any
ActiveX components from an unknown source, as a malicious site could use an
old vulnerable version of the ActiveX control even after the patched ActiveX
component is available from Microsoft. If users install the latest vendor
cumulative patch for Internet Explorer this problem is eliminated.

The vulnerability affects Windows 98, 98(2E), NT4.0, Millennium, 2000 and
XP. A cumulative patch
will be available later today, which also addresses a similar, but less
serious vulnerability discovered in the SmartCard Enrollment control in
Windows 2000 XP. For those that want to download the patch immediately, click
on the your system’s version of Windows:

Customers who operate web sites that use the Certificate Enrollment Control
will need to make minor revisions to their web applications in order to use
the new control. A patch for operators sets the “Kill Bit” on the original
version of the control, and provides a new control.