Print - Microsoft Issues Zero-Day Exploit Warning

Microsoft released a rare warning for a "zero-day" vulnerability in an ActiveX control running on Windows XP or Server 2003 that is being exploited by hackers. The company doesn't have a patch ready to fix the issue yet, but because the vulnerability is being actively exploited, Microsoft is alerting customers and providing a temporary workaround.

"Microsoft issued Security Advisory 972890 to address a new vulnerability in a Microsoft Video ActiveX Control affecting Windows XP and Windows Server 2003 that could allow remote code execution if a user browses to a specially-crafted Web page," a Microsoft representative told me. "We are aware of limited, active attacks that exploit this vulnerability."

"Our investigation has shown that there are no by-design uses for this ActiveX Control within Internet Explorer," the representative continued. "Therefore, we recommend that all customers implement the workarounds outlined in the Security Advisory. While Windows Vista and Windows Server 2008 customers are not affected by this vulnerability, we recommend that they also implement the workarounds as a defense-in-depth measure."

Microsoft includes a simple "Fix it for me" link in its Security Advisory that will automatically implement the workaround on affected systems.

although it breaks a lot of stuff that websites do now, disabling activex, javascript, java, and all other plugins is still the safest way to surf.

scottm99999: Then what's the point? infiniteloop: Snarky, but correct Waethorn: Show me how an ActiveX vulnerability affects OSX and then we'll talk. Until then, please STFU. Paul: Thanks for the link. Going there now.

"The safest way to surf is still on a Mac." To be as snarky as possible, I'd say the safest way to surf is to not surf at all. Although Mac users like to feel invincible, and their historically low marketshare numbers have kept them out of the financially driven malware writers scopes, the risks of phishing attacks are still just as possible on a Mac, Linux, or Windows. And with the increased marketshare numbers that Apple has been experiencing, there is now a small but steady stream of exploits being developed that target the Mac. While ActiveX of course does not affect anything other than IE, Wae is correct in pointing out that even with a tough and secure operating system, like Leopard or Vista, unpatched and vulnerable third-party software can be easily exploited. Some of the most insecure software, such as QuickTime and the Adobe Reader are widely installed on both platforms. You're only as good as your weakest link. In fact, this issue is widely mitigated on Vista/7, since they operate in protect mode.

web still looks pretty good to me, even with no plugins (i'm a bit old-fashioned). i enable plugins now & then, for trusted sites, but never permanently; malware is just so darned pervasive. i opt for reduced functionality, but more safety.

@losta: Show me a Java security hole on the Windows client that has been open for more than 6 months, and exploited. Otherwise, go back under your bridge. OH, and STFU yourself.