Vulnerabilities / Threats
7/13/2009
01:35 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Microsoft Warns Of Third 'Browse-And-Get-Owned' Flaw

A third zero-day vulnerability in Microsoft's software has been identified, Microsoft said on Monday, a day before the company plans to release its July software patch.

Despite moving aggressively to fix zero-day vulnerabilities in its software, Microsoft will have to move faster still to keep up with criminal hackers. One day before the company plans to release its July patch and fix two "browser-and-get-owned" vulnerabilities, a third "browse-and-get owned" flaw has been reported.

On Monday, Microsoft issued a Security Advisory about a previously undisclosed vulnerability in Office Web Components Spreadsheet ActiveX control (OWC 10 and OWC11).

"The vulnerability exists specifically in the Spreadsheet ActiveX Control and could allow an attacker who successfully exploited this vulnerability the same user rights as the local user," the Microsoft advisory states. "We are aware of limited, active attacks attempting to exploit this vulnerability."

Last week, Microsoft issued a Security Advisory about a vulnerability in its Video ActiveX Control.

Microsoft security engineer Fermin J. Serna said in a post on the company's Security Research & Defense blog that a "browse and get owned" scenario exists, but the user would have to visit a malicious Web site for this to happen.

Microsoft has provided a workaround, a "Fix It" link that disables the vulnerable components. It's unlikely that Microsoft will have time to test a fix to include in the patch it plans to issue tomorrow.

The two vulnerable components are not installed by default, but they can be installed with Office XP, Office 2003, Office 2007, BizTalk, ISA Server, or Office Accounting and Business Contact Manager.

On Windows Server 2003 and Windows Server 2008, a possible attack is likely to be less effective. That's because the default configurations for those two Windows operating systems include something called Enhanced Security Configuration, which prevents ActiveX controls from loading in the Internet Zone when browsing.

Users of Internet Explorer 7 or 8 who visit a malicious Web site attempting to exploit this vulnerability without the vulnerable components installed should see a gold bar prompt asking permission to install the components.

If that happens, just say no.

Black Hat is like no other security conference. It happens in Las Vegas, July 25-30. Find out more and register.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0985
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName parameter.

CVE-2014-0986
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd parameter.

CVE-2014-0987
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parameter.

CVE-2014-0988
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameter.

CVE-2014-0989
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter.

Best of the Web
Dark Reading Radio