Vulnerabilities / Threats
7/9/2009
05:58 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Microsoft Fix For 'Browse-And-Get-Owned' Flaw Coming Tuesday

Two zero-day vulnerabilities, one reported last week, will be fixed in Microsoft's monthly patch release next week.

Moving with uncharacteristic speed, Microsoft plans to fix what it has called a "browse-and-get-owned" vulnerability in its Video ActiveX Control when it releases its July software patches next week.

The company acknowledged the vulnerability last week. It is also planning to fix a second "browse-and-get-owned" vulnerability in its DirectShow software that was disclosed in May.

Both of these flaws affect older version of Windows; Windows Vista and Windows Server 2008 are not affected.

'[O]ur engineering teams have been working around the clock to produce an update for [the Microsoft Video ActiveX Control vulnerability] and we believe that they will be able to release an update of appropriate quality for broad distribution that protects against the attacks we detailed in the advisory," said Jerry Bryant, senior security program manager at Microsoft, in a blog post on Thursday.

Microsoft said in an advanced summary of its upcoming July 14 security patch that it plans to release six security bulletins.

Three will be "critical" updates for Windows, one of which affects Windows Vista and Windows Server 2008. There will also be one "important" update for Publisher, one "important" update for Internet Security and Acceleration (ISA) Server, and one "important" update for Virtual PC and Virtual Server.

Security vendors Trend Micro and Websense have noted that the ActiveX flaw is being actively exploited on Web sites in China.

"Around 967 Chinese Web sites are reported to be infected by a malicious script that leads users to successive site redirections and lands them to download a .JPG file containing the exploit," said Trend Micro security engineer Roland Dela Paz in a blog post.

And Bryant said that Microsoft is aware of limited attempts to exploit the DirectShow vulnerability.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5700
Published: 2014-09-22
Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.2f allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to admin/index.php or the (2) username or (3) password parameter in blocks/loginbox/loginbox.template.php to index.php. NOTE: some o...

CVE-2014-0484
Published: 2014-09-22
The Debian acpi-support package before 0.140-5+deb7u3 allows local users to gain privileges via vectors related to the "user's environment."

CVE-2014-2942
Published: 2014-09-22
Cobham Aviator 700D and 700E satellite terminals use an improper algorithm for PIN codes, which makes it easier for attackers to obtain a privileged terminal session by calculating the superuser code, and then leveraging physical access or terminal access to enter this code.

CVE-2014-3595
Published: 2014-09-22
Cross-site scripting (XSS) vulnerability in spacewalk-java 1.2.39, 1.7.54, and 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web script or HTML via a crafted request that is not properly handled when logging.

CVE-2014-3635
Published: 2014-09-22
Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows remote attackers to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one m...

Best of the Web
Dark Reading Radio