ActiveX Controls Still Vulnerable After Four Years
451053
Activity spotted by an eWeek reporter on at least two "gray-hat" vulnerability research sites appears to indicate that an exploit for a weakness in one of Microsoft's Multimedia ActiveX controls discovered last June may still be feasible, even after four years of patches.
265180
Microsoft has released bulletin MS04-039 reporting a security vulnerability in Internet Security and Acceleration (ISA) Server 2000 and in Proxy Server 2.0, and has also announced the availability of the patches to resolve these issues.
576299
Flawed ActiveX controls used to upload photos on the popular social networking sites Facebook and MySpace can be used by hackers to snatch control of Windows PCs, according to security researchers.
116589
Some say Win XP SP2 enhancements cause conflicts, don't protect as claimed.
101525
Apple has issued a fix for its Airport Extreme product, which it says would prevent attackers from causing system crashes on computers connected to a network. Only Intel Core Duo systems are affected, according to an advisory.
472677
Zero-day flaw, which is could let attacker gain remote access to a system, affects Word 2000, 2002 and 2003 and Word Viewer 2003.
178790
Considered important vulnerabilities that leave users open to attack in Microsoft&#39;s (Nasdaq: MSFT) Windows for desktop and server installations, the Redmond
83975
Three different ActiveX vulnerabilities affect Yahoo Instant Messenger version 3.5,  and Yahoo Messenger versions 4.0, 5.0, and 5.5
411156
Microsoft's consumer security software changes the AU (Automatic Updates) settings in Windows XP and Vista without telling users or getting their approval, a researcher said Thursday -- behavior that may explain recent reports of patches being installed and systems rebooting without permission.When Microsoft responded to new charges of silent changes last week, however, it denied that AU settings were ever altered without user approval, and it didn't mention OneCare as a possible culprit.Scott Dunn, an editor at the "Windows Secrets" newsletter, reported Thursday morning that OneCare silently changes AU settings as it installs. No matter what AU setting the user selected previously, OneCare's installer quietly changes it to the fully automatic option."Some security products have turned on AU in the past," said Dunn, who also tested several other current consumer suites, including Symantec's Norton 360 and Norton Internet Security, McAfee's Internet Security Suite, and Check Point Software's ZoneAlarm Internet Security Suite. "But OneCare was the only guilty party."OneCare's willful way with AU may be an explanation for the reports two weeks ago of machines downloading and installing the Oct. 9 set of security fixes even though their owners had explicitly instructed Windows to ignore all downloads or notify them before they were installed.Several days later, after it wrapped up an investigation, Microsoft said AU settings were never changed without user consent, and it blamed absent-minded users for making modifications and then forgetting that they had."I find this surprising and very disturbing," said Dunn. "If they're going to change [AU] settings, they should let you know."Four options, down to one In both Windows XP and Vista, users can select from four options in AU: Download and install all updates automatically; download files but do not install them without user consent; check for but neither download nor install without permission; and disable Automatic Updates entirely.OneCare, sold for $49.95 and offered as a free 90-day trial, sets AU to the first, and all-automatic, setting, said Dunn, on both operating systems. "It does that even if Automatic Updates is completely disabled," he added. If users later uninstall OneCare -- for instance, after a trial has expired -- the software does not return the machine to the earlier settings; they must be reset by the user."Worse, OneCare silently turns on [Windows] services that have been disabled by the user," Dunn said, referring to the two services that some users, frustrated at earlier incidents in which Windows retrieved and installed patches without permission, have manually turned off: Automatic Updates and Background Intelligent Transfer Service. The services can be switched off manually using the Windows services.msc utility. Normally, once disabled, they remain that way until the user manually turns them back on.ComputerWorld confirmed Dunn's account of OneCare's AU changes by installing the security suite on both Windows XP and Windows Vista.At no time during installation, said Dunn, does OneCare tell the user that the software will modify Windows' settings or provide an opt-in dialog. Nor do the various online documents -- including Microsoft's privacy statement and an addendum for OneCare -- that are offered up early during the process contain any information about the changes. "It turns out there's a brief mention of it buried deep in one of the OneCare help files," said Dunn. "But that's not the same as telling users upfront."The help file (select "What does Windows Live Update do to help manage and maintain my computer's software updates?" to view the pertinent section) acknowledges that OneCare makes changes without bothering to ask. "When you first install Windows Live OneCare, setup automatically enlists your computer in Microsoft Update and changes your computer's settings to download and install updates automatically using Automatic Updates," it reads.Who's 'forgetful' now? Although Microsoft was not immediately available for comment this morning, it made it clear last week that reports of unauthorized updates, and even PC reboots, could not be blamed on its software."I want to stress that the Windows Update client does not change AU settings without users' consent," said Nate Clinton, a program manager with the Microsoft Update team in a company blog entry a week ago. He went on to list five possible explanations; all require the user to take action or accept one option from several offered.Earlier, a Microsoft spokeswoman had been more blunt. "It may be more a case of someone clicking to change their AU settings but not realizing/remembering doing so," she said last Tuesday. She also called out OneCare's installation as one such possible moment and claimed that the security suite offered users the option of changing AU settings. It does not."This is just one more example of Microsoft having the attitude that we know better than you do, that you should just stop asking questions and let us do what we want," said Dunn.Computerworld is an InfoWorld affiliate
619820
(InfoWorld) - A vulnerability in Ask.com's toolbar for Internet Explorer could allow an attacker to take control of a person's computer, according to security advisories. The problem concerns a buffer overflow flaw in the toolbar and involves an ActiveX control, according to an advisory posted by security vendor Secunia APS, which rated the problem as "highly critical," its second most severe rating. It affects version 4.0.2 of the toolbar and possibly others. Proof-of-concept exploit code for the vulnerability has been publicly posted on other disclosure forums, with a person named "Joey Mengele" credited with finding the flaw. Ask.com officials contacted in London were not immediately able to comment. The Ask.com toolbar sits below the address bar and can perform a variety of category-specific searches, such as weather information, stock quotes, or search a person's desktop as well as regular Web searching. As of Tuesday afternoon local time,Â WabiSabi Labi, a Swiss company that specializes in selling vulnerability information, was still auctioning the Ask.com toolbar problem for minimum of â¬500 ($705), although no bids were listed. WabiSabi Labi's auctioning of security vulnerabilities has caused a stir among security analysts who believe software companies should be discreetly notified of vulnerabilities and allowed to patch the software so as to not put users in danger. The company maintains security researchers should be rewarded for their work.
370540
A wave of bugs in the plug-in technology used by Microsoft's browser has some security experts recommending that users disable all ActiveX controls.
662074
(InfoWorld) - Yahoo has fixed a serious vulnerability in its Messenger instant messaging client. The patch, posted Thursday, fixes a critical flaw in the ActiveX control used by Messenger's Webcam feature. According to security experts, this flaw could be exploited by hackers to install unauthorized software on a victim's PC. The patch came after two sample attacks that exploited the vulnerability were posted to the Full Disclosure security discussion list. EEye Digital Security first reported the issue on Wednesday without disclosing specific details of the bug. The security vendor considers the flaw to be serious. "ActiveX remote code execution vulnerabilities have very high impacts because the source of the malicious payload can be any site on the Internet," eEye said in its alert. This is the third time in recent months that Yahoo has had to patch an ActiveX control flaw in Messenger. It patched these other bugs in March and December.
197741
(Source: Qualys) Consistent, ongoing execution of vulnerability management and policy compliance is difficult, if not impossible to do on a manual basis. There are simply too many "moving parts" to juggle and act on in a timely and cost-effective manner. This guide provides a step-by-step guide for automating the vulnerability and compliance workflow process.
247413
OS security fix is being rolled out to users who have enabled Automatic Updates.
147320
Patch for Messenger addresses zero-day exploits that take advantage of vulnerabilities in its Webcam ActiveX controls.
419635
U.S. CERT warns of critical ActiveX bugs in QuickBooks online service; Intuit says developers fixed the problems months ago.
224832
Upgrade or be own3d A vulnerability in MSN Messenger poses a severe risk of compromise for users of older versions of the software who accept untrusted web cam sessions.â¦