Microsoft issues advisory for ActiveX flaw

By

Vulnerability in Windows Shell could allow remote code execution.

Microsoft issues advisory for ActiveX flaw
Microsoft has issued a security advisory about a vulnerability that affects nearly all versions of Windows that the company still supports.

While the company claimed that it is not aware of any active exploits for the vulnerability, security advisory 926043 details the flaw in the WebViewFolderIcon ActiveX control in Windows Shell. 

According to Microsoft, the vulnerability could be exploited by viewing a maliciously-crafted HTML file.

Once the exploit has been launched, an attacker could execute code remotely on the compromised PC, including malware and spyware programs.

A spokesman said that a patch is set to be released as part of Microsoft's next scheduled update on 10 October.

Microsoft suggests several workarounds in the meantime, including setting Internet Explorer to ask permission before running ActiveX. This will cause frequent requests as a large number of sites use ActiveX controls.

The US Computer Emergency Response Team recommends users to avoid clicking on unsolicited or otherwise suspicious links. 

The SANS Internet Storm Centre suggests that users should think about switching from Internet Explorer to other web browsers. 

Microsoft said that versions of Windows Server 2003 and Windows Server 2003 Service Pack 1 with the Enhanced Security Configuration enabled were not affected by the vulnerability.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Log In

  |  Forgot your password?