By Robert Westervelt | Jul 7, 2009
Security researchers detected a new drive-by exploit in the wild actively targeting a zero-day vulnerability in an ActiveX component that connects to the Microsoft DirectShow video streaming software.
Microsoft issued a security advisory today calling the vulnerability in its Video ActiveX Control [8] remotely exploitable with little user interaction when browsing with Internet Explorer. The ActiveX control msvidctl.dll connects to Microsoft DirectShow filters for use in capturing, recording, and playing video. The specific control is used by Windows Media Center to build filter graphs for recording and playing television video.
The software maker also issued an automated workaround [9] until a patch is released.
Users of Windows 2000, 2003 or XP with Internet Explorer 6 and 7 are impacted by the attacks. Computers running Windows Vista or Windows Server 2008 are not affected by the attack.
The vulnerability is different from a DirectShow flaw [10] acknowledged by Microsoft in May.
According to Symantec Corp., the exploit uses a JavaScript file and a data file to exploit the vulnerability in the video streaming ActiveX control. A victim must browse to a website hosting the malicious files.
"When a user visits a malicious website hosting these files, the vulnerability allows remote code execution and malicious files are downloaded," Symantec engineer Joji Hamada [11] wrote on Symantec's security blog.
An attacker who successfully exploits the vulnerability could gain the same user rights as the local user, according to Microsoft.
Stephen Hall of the SANS Internet Storm Center said a valid work around for the attack vector is available which sets the kill bit on the vulnerable DLL [12]. Hall posted details of the exploit [13].
Researchers say users of antivirus or IPS/IDS should ensure their signatures are up to date.
"It is likely to be widely deployed with the code being available," Hall wrote.
Updated with Microsoft information.
Links:
[1] http://www.searchsecurityasia.com/content/new-exploit-locks-microsoft-activex-zero-day-vulnerability#comment
[2] http://www.facebook.com/share.php?u=http://www.searchsecurityasia.com/content/new-exploit-locks-microsoft-activex-zero-day-vulnerability
[3] http://www.linkedin.com/shareArticle?mini=true&url=http://www.searchsecurityasia.com/content/new-exploit-locks-microsoft-activex-zero-day-vulnerability&title=New exploit locks on to Microsoft ActiveX zero-day vulnerability&summary=A new drive-by exploit has surfaced targeting a zero-day vulnerability in Microsoft's video streaming software, DirectShow.&source=searchsecurityasia.com
[4] http://del.icio.us/post?url=http://www.searchsecurityasia.com/content/new-exploit-locks-microsoft-activex-zero-day-vulnerability&title=New exploit locks on to Microsoft ActiveX zero-day vulnerability
[5] http://www.digg.com/submit?url=http://www.searchsecurityasia.com/content/new-exploit-locks-microsoft-activex-zero-day-vulnerability&title=New exploit locks on to Microsoft ActiveX zero-day vulnerability&bodytext=A new drive-by exploit has surfaced targeting a zero-day vulnerability in Microsoft's video streaming software, DirectShow.
[6] http://www.searchsecurityasia.com/forward?path=node/6233
[7] http://www.searchsecurityasia.com/print/6233
[8] http://www.microsoft.com/technet/security/advisory/972890.mspx
[9] http://support.microsoft.com/kb/972890
[10] http://www.searchsecurityasia.com/content/cybercriminals-exploit-microsoft-directshow-flaw
[11] http://www.symantec.com/connect/blogs/let-celebration-come-end
[12] http://translate.google.com/translate?prev=hp&hl=en&js=n&u=http://www.csis.dk/dk/nyheder/nyheder.asp?tekstID=799&sl=da&tl=en&history_state0=
[13] http://isc.sans.org/diary.html?storyid=6733#comment
0 comments
Facebook
LinkedIn
Digg
