Microsoft Video ActiveX Control rule coverage

Tuesday, July 7, 2009 12:11

So, a bit of a problem with an ActiveX control that can be leveraged via a webpage, without any user interaction required. Who would've expected that?

Microsoft Security Advisory (972890):
The Microsoft Video ActiveX control contains a vulnerability that may allow a remote attacker to execute code on a vulnerable system. The attacker may take advantage of the vulnerability via a call to the ActiveX control from Internet Explorer. This vulnerability requires no user interaction and is being actively exploited.

Rules to detect attacks targeting this vulnerability are included in this release and are identified with GID 1, SIDs 15588 through 15677.

Detailed changelogs can be found here: http://www.snort.org/vrt/advisories/2009/07/07/vrt-rules-2009-07-07.html/