Vulnerabilities / Threats
7/13/2009
01:35 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Microsoft Warns Of Third 'Browse-And-Get-Owned' Flaw

A third zero-day vulnerability in Microsoft's software has been identified, Microsoft said on Monday, a day before the company plans to release its July software patch.

Despite moving aggressively to fix zero-day vulnerabilities in its software, Microsoft will have to move faster still to keep up with criminal hackers. One day before the company plans to release its July patch and fix two "browser-and-get-owned" vulnerabilities, a third "browse-and-get owned" flaw has been reported.

On Monday, Microsoft issued a Security Advisory about a previously undisclosed vulnerability in Office Web Components Spreadsheet ActiveX control (OWC 10 and OWC11).

"The vulnerability exists specifically in the Spreadsheet ActiveX Control and could allow an attacker who successfully exploited this vulnerability the same user rights as the local user," the Microsoft advisory states. "We are aware of limited, active attacks attempting to exploit this vulnerability."

Last week, Microsoft issued a Security Advisory about a vulnerability in its Video ActiveX Control.

Microsoft security engineer Fermin J. Serna said in a post on the company's Security Research & Defense blog that a "browse and get owned" scenario exists, but the user would have to visit a malicious Web site for this to happen.

Microsoft has provided a workaround, a "Fix It" link that disables the vulnerable components. It's unlikely that Microsoft will have time to test a fix to include in the patch it plans to issue tomorrow.

The two vulnerable components are not installed by default, but they can be installed with Office XP, Office 2003, Office 2007, BizTalk, ISA Server, or Office Accounting and Business Contact Manager.

On Windows Server 2003 and Windows Server 2008, a possible attack is likely to be less effective. That's because the default configurations for those two Windows operating systems include something called Enhanced Security Configuration, which prevents ActiveX controls from loading in the Internet Zone when browsing.

Users of Internet Explorer 7 or 8 who visit a malicious Web site attempting to exploit this vulnerability without the vulnerable components installed should see a gold bar prompt asking permission to install the components.

If that happens, just say no.

Black Hat is like no other security conference. It happens in Las Vegas, July 25-30. Find out more and register.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-6090
Published: 2015-04-27
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam Social Program Management (SPM) 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix...

CVE-2014-6092
Published: 2015-04-27
IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to cause...

CVE-2015-0113
Published: 2015-04-27
The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next Generation...

CVE-2015-0174
Published: 2015-04-27
The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

CVE-2015-0175
Published: 2015-04-27
IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.