Rogue ActiveX controls menace users
349775
A new class at Vulnerability High Flaws in ActiveX controls are being increasingly used to run security exploits.â¦
95664
A attack on Windows machines that uses Internet Explorer and a vulnerability in a RealPlayer ActiveX control is spreading in the wild, and researchers say the situation is urgent.
86222
In brief Exploit circulating for unpatched vuln
662074
(InfoWorld) - Yahoo has fixed a serious vulnerability in its Messenger instant messaging client. The patch, posted Thursday, fixes a critical flaw in the ActiveX control used by Messenger's Webcam feature. According to security experts, this flaw could be exploited by hackers to install unauthorized software on a victim's PC. The patch came after two sample attacks that exploited the vulnerability were posted to the Full Disclosure security discussion list. EEye Digital Security first reported the issue on Wednesday without disclosing specific details of the bug. The security vendor considers the flaw to be serious. "ActiveX remote code execution vulnerabilities have very high impacts because the source of the malicious payload can be any site on the Internet," eEye said in its alert. This is the third time in recent months that Yahoo has had to patch an ActiveX control flaw in Messenger. It patched these other bugs in March and December.
200263
Secunia issued a warning that the so-called tabbed browsing function in many alternative Web browsers from Mozilla, Opera, Netscape, Avant, Camino and others leave users vulnerable to spoofed
484041
Online miscreants have released a Trojan horse that can infect computers running Microsoft&#39;s Windows XP, installing programs to remotely control a victim&#39;s system.
135214
Vulnerability could allow an attacker to gain complete control of a system.
745068
InfoWorld - A recent string of high-profile ActiveX vulnerabilities caused the U.S. Computer Emergency Readiness Team (US-CERT) to advise users to disable the ubiquitous Microsoft browser plug-in technology altogether. The vectors for these recent exploits include a third-party image uploading tool used on both the Facebook and MySpace social networking sites, and flaws found in Yahoo's Music Jukebox, Real Networks' RealPlayer, and Apple's QuickTime.
576299
Flawed ActiveX controls used to upload photos on the popular social networking sites Facebook and MySpace can be used by hackers to snatch control of Windows PCs, according to security researchers.
462043
Nasty ActiveExploit Security flaws in an ActiveX control used in MySpace upload images onto the social networking sites leave users open to attack. Facebook users may also be at risk.â¦
656679
Security hole in ePolicy Orchestrator and ProtectionPilot could let an outsider take complete control of a system.
259952
Just one day after hackers showed how to exploit a number of flaws in the ActiveX software used by Internet Explorer, Symantec has spotted online criminals using one of the attacks.The attack, which was first observed in the last few hours, is not widespread at present. Symantec Security Response Director Oliver Friedrichs said Tuesday that the company had identified just three Web sites that were hosting the attack code, all of which seem to be linked to the same criminals. But he believes that more attacks are inevitable as the bad guys work the code into their malicious toolkits of software. &quot;Given the fact that the proof of concept is available and works, it&#39;s not exactly rocket science for someone to plug this into [a toolkit],&quot; he said. &quot;That&#39;s likely to happen in short order.&quot;Security researchers Elazar Broad and Krystian Kloskowski have disclosed a slew of ActiveX bugs affecting MySpace and Facebook over the past few days, but the attack reported by Symantec takes advantage of a flaw in an ActiveX control used by Yahoo&#39;s Music Jukebox.After the attackers are able to install software on the victim&#39;s machine, they then begin installing a number of malicious files on the victim&#39;s computer, Symantec said.Broad and Kloskowski also discovered a second ActiveX bug in Yahoo Jukebox, but that flaw is not yet being exploited by attackers, according to Symantec. Another major source of problems is the Aurigma ImageUploader ActiveX control, which is used by Web sites such as Facebook and MySpace to upload pictures into Internet Explorer.Because of all the ActiveX bugs, Security experts are warning users to be cautious while Web browsing. On Tuesday, US-CERT (United States Computer Emergency Readiness Team) published a note encouraging users to disable ActiveX controls, which can be done by setting Internet Explorer&#39;s security level to &quot;high&quot; for the Internet zone.That may not be a realistic option for many consumers, who will find their Internet Explorer browsing experience hobbled without ActiveX, Friedrichs said. But tech-savvy users and corporate IT shops can take steps to disable the untrusted ActiveX controls. In fact, the SANS Internet Storm Center has published free software that disables the controls.Another option for enterprise users is to create a whitelist of approved ActiveX controls, Friedrichs said.Security problems with browser add-ons are very common. In the first half of 2007, Symantec identified 237 browser plugin security flaws. About 89 percent of centered on ActiveX.Yahoo did not immediately respond to an e-mail message requesting comment for this story.
524524
An attack utilizing a vulnerability in an ActiveX control for the popular RealPlayer media program may be spending in a more more dangerous fashion than anyone realized. Exploit code for the vuln has been found embedded in ads served up from a popular advertising site.
52844
Another candidate in the growing list of exploits on instant messaging clients and servers arrived in the wild. Called W32.Funner, the worm on Monday circulated to attack on the Windows Messenger platform.
619820
(InfoWorld) - A vulnerability in Ask.com's toolbar for Internet Explorer could allow an attacker to take control of a person's computer, according to security advisories. The problem concerns a buffer overflow flaw in the toolbar and involves an ActiveX control, according to an advisory posted by security vendor Secunia APS, which rated the problem as "highly critical," its second most severe rating. It affects version 4.0.2 of the toolbar and possibly others. Proof-of-concept exploit code for the vulnerability has been publicly posted on other disclosure forums, with a person named "Joey Mengele" credited with finding the flaw. Ask.com officials contacted in London were not immediately able to comment. The Ask.com toolbar sits below the address bar and can perform a variety of category-specific searches, such as weather information, stock quotes, or search a person's desktop as well as regular Web searching. As of Tuesday afternoon local time,Â WabiSabi Labi, a Swiss company that specializes in selling vulnerability information, was still auctioning the Ask.com toolbar problem for minimum of â¬500 ($705), although no bids were listed. WabiSabi Labi's auctioning of security vulnerabilities has caused a stir among security analysts who believe software companies should be discreetly notified of vulnerabilities and allowed to patch the software so as to not put users in danger. The company maintains security researchers should be rewarded for their work.
206847
A newly identified malicious program not only messes up its victims' computers, it taunts them too.
756098
A recent string of high-profile ActiveX vulnerabilities caused the U.S. Computer Emergency Readiness Team (US-CERT) to advise users to disable the ubiquitous Microsoft browser plug-in technology altogether. The vectors for these recent exploits include a third-party image uploading tool used on both the Facebook and MySpace social networking sites, and flaws found in Yahoo's Music Jukebox, Real Networks' RealPlayer, and Apple's QuickTime.                                                    "We're seeing an increase in exploits aimed at these types of tools that are commonly used with a variety of technologies including social networking sites and multimedia players. As online crime becomes more prominent, malicious actors are taking advantage of these types of vulnerabilities to accomplish their objectives," said a spokesman at the U.S. Department of Homeland Security, which oversees the US-CERT.Security experts contend that there's no end in sight for attacks on the plug-in architecture.One reason is that there are plenty of security holes in ActiveX to be exploited. But another reason is not Microsoft's fault, they say: any technology used so widely will attract hacker attacks. "There's simply a lot of software out there using ActiveX that's either preloaded or embedded that users don't even realize is there, and that's why it was necessary to make the advisory," the US-CERT spokesman said.Although features added in Microsoft's newest Web browser, Internet Explorer 7, may help reduce the problem down the road and push attackers to move on to new targets, ActiveX will remain among the leading programs assaulted by opportunistic cyber-criminals, at least for the foreseeable future, several researchers say. After all, they say, Internet Explorer's status as the most used Web browser makes it an attractive target, just as the Windows operating system has been subject to constant attack for the past decade due to its huge market share. "When hackers spend time trying to find vulnerabilities to exploit, they want to make sure that they can affect the highest number of people," said Will Dormann, a vulnerability analyst at the Carnegie Mellon Software Engineering Institute CERT.A juicy target that's easier to exploit When you ask researchers which ActiveX exploits make them curl their toes in reaction, the answers don't tend to focus on specific sets of attacks but instead on the sheer volume and variety of the threats, and the vulnerabilities that allow for them.Some of the most prominent examples of ActiveX exploits include malware attacks aimed at Microsoft's Data Access Component (MDAC) software, which was pummeled for years by a broad range of attacks, and problems with the HTML Help ActiveX control module in Internet Explorer that opened it to numerous types of attacks, most notably the Phel Trojan virus.These well-known examples are just the tip of the iceberg for the vulnerabilities that ActiveX exposes users to. One reason is that as Microsoft fixes vulnerabilities in Windows, hackers are moving to easier targets, such as ActiveX, said Randy Abrams, director of technical education at ESET, a maker of anti-malware software. "Applications and plug-ins like ActiveX are the new low-hanging fruit so that's what's being attacked," he said.Abrams believes that ActiveX introduces unnecessary risk in many cases, because it is typically used for nonessential purposes. "The truth is that the ActiveX problem is also based on an irrational love of fashion; it's all about adding functionality to sites and applications to make them look cool, but in actuality it's completely unnecessary," he said. "If it wasn't for this need to make things look fashionable there would be much less risk." But Abrams doesn't expect developers to throttle back ActiveX use despite its security risks: "The cat is out of the bag, and sites now compete to look visually impressive and offer better functionality."Many developers of ActiveX-based applications do a poor job of ensuring security, notes Craig Schmugar, a threat researcher at McAfee's Avert Lab. And that threat grows as the number of ActiveX applications grows. "You can improve developer education, but hackers are likely to keep attacking the soft targets," he said.It's also become easier for hackers to find ActiveX's flaws, thanks to the broad availability of fuzzing tools. "The publicly available fuzz testing tools for ActiveX make it relatively simple to find new vulnerabilities and controls to go after, so people are able to research how exploitable certain applications may be before writing their attacks," said Carnegie Mellon's Dormann. "People are finding new holes all the time and posting them to public mailing lists," he added."One of the most telling things to look at with ActiveX is that security researchers delving into these problems don't get a lot of respect within the vulnerability research community itself," Schmugar noted. "That's mostly because with the sheer number of holes, and all the available fuzzing tools, people look at it like shooting fish in a barrel."IE7 improvements should help over time Microsoft is well aware that ActiveX is both a big target for hackers and one that they can successfully attack. So the company has re-architected its Internet Explorer Web browser in version 7 to limit the scope of well-known attacks methods. Researchers say that the work should eventually produce dividends.For example, the original implementation of ActiveX in IE6 and previous versions exposed binaries to any page visited by users. By contrast, IE7 provides far less access to sites and applications, preventing malware authors from activating code that would let them hack the browser.Microsoft has configured IE7's defaults so that only "safe" ActiveX controls (as determined by Microsoft) can be accessed, and it has enhanced separation of controls to prevent exploits from running roughshod across the entire Internet Explorer application as they often did in the past, researchers said. "IE7's protected mode definitely helps, even if the root cause in the form of ActiveX vulnerabilities is still present, and in the long run it will play a role in convincing attackers to move elsewhere, but with Vista and IE7 in relatively few hands this won't happen soon," said McAfee's Schmugar. Improvements made in the Windows Vista operating system should also help reduce the impact of traditional ActiveX attack techniques, he noted.However, most people use neither Vista nor IE7, so these improvements aren't widely deployed. The majority of users run IE6 on Windows XP, both of whose ActiveX components remain largely unchanged and thus at high risk.Dumping ActiveX is not the long-term solution Given that ActiveX is compatible only with Microsoft's Windows browsers, you might conclude the safest solution to the security threat is to use alternative technologies such as JavaScript.That strategy may work for a while, researchers said. But as alternative browser plug-in technologies gain adoption, they too will become more significant targets for attackers. Researchers cite the increasing attacks aimed at the Mozilla Firefox and Apple Safari browsers as they gained in popularity, as well as the likelihood of more Mac OS-based threats as that operating system continues to gain market share. And JavaScript is no stranger to attacks, either."The issue goes beyond ActiveX. Any plug-in architecture that has a lot of users will suffer from these same issues; anything where you have third party developers writing code that runs inside the browser," said Max Caceres, director of research and development at applications security firm Matasano Security. "As long as developers are building things without putting security at the top of their list of objectives, we'll have these problems, regardless of the plug-in architecture."