Security researchers detected a new drive-by exploit in the wild actively targeting a zero-day vulnerability in an ActiveX component that connects to the Microsoft DirectShow video streaming software.
Microsoft issued a security advisory today calling the vulnerability in its Video ActiveX Control remotely exploitable with little user interaction when browsing with Internet Explorer. The ActiveX control msvidctl.dll connects to Microsoft DirectShow filters for use in capturing, recording, and playing video. The specific control is used by Windows Media Center to build filter graphs for recording and playing television video.
The software maker also issued an automated workaround until a patch is released.
Users of Windows 2000, 2003 or XP with Internet Explorer 6 and 7 are impacted by the attacks. Computers running Windows Vista or Windows Server 2008 are not affected by the attack.
The vulnerability is different from a DirectShow flaw acknowledged by Microsoft in May.
"When a user visits a malicious website hosting these files, the vulnerability allows remote code execution and malicious files are downloaded," Symantec engineer Joji Hamada wrote on Symantec's security blog.
An attacker who successfully exploits the vulnerability could gain the same user rights as the local user, according to Microsoft.
Researchers say users of antivirus or IPS/IDS should ensure their signatures are up to date.
"It is likely to be widely deployed with the code being available," Hall wrote.
Updated with Microsoft information.