New attack code targets Microsoft ActiveX zero-day vulnerability

UPDATED: A new drive-by exploit has surfaced targeting an ActiveX zero-day vulnerability for streaming video.

SearchSecurity.com:

To get security news and tips delivered to your inbox,  click here to sign up for our free newsletter.

Security researchers detected a new drive-by exploit in the wild actively targeting a zero-day vulnerability in an ActiveX component that connects to the Microsoft DirectShow video streaming software.

Microsoft issued a security advisory today calling the vulnerability in its Video ActiveX Control remotely exploitable with little user interaction when browsing with Internet Explorer. The ActiveX control msvidctl.dll connects to Microsoft DirectShow filters for use in capturing, recording, and playing video. The specific control is used by Windows Media Center to build filter graphs for recording and playing television video.

The software maker also issued an automated workaround until a patch is released.

Users of Windows 2000, 2003 or XP with Internet Explorer 6 and 7 are impacted by the attacks. Computers running Windows Vista or Windows Server 2008 are not affected by the attack.

The vulnerability is different from a DirectShow flaw acknowledged by Microsoft in May. 

DirectShow vulnerability:

May 29 - Hackers targeting unpatched Microsoft DirectShow flaw: Software giant is investigating a newly discovered flaw in DirectShow's QuickTime parser that could allow an attacker to execute code remotely.

According to Symantec Corp., the exploit uses a JavaScript file and a data file to exploit the vulnerability in the video streaming ActiveX control. A victim must browse to a website hosting the malicious files.

"When a user visits a malicious website hosting these files, the vulnerability allows remote code execution and malicious files are downloaded," Symantec engineer Joji Hamada wrote on Symantec's security blog.

An attacker who successfully exploits the vulnerability could gain the same user rights as the local user, according to Microsoft.

Stephen Hall of the SANS Internet Storm Center said a valid work around for the attack vector is available which sets the kill bit on the vulnerable DLL. Hall posted details of the exploit.

Researchers say users of antivirus or IPS/IDS should ensure their signatures are up to date.

"It is likely to be widely deployed with the code being available," Hall wrote.


Updated with Microsoft information.

Dig deeper on Windows Security: Alerts, Updates and Best Practices

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close