-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
National Cyber Alert System
Cyber Security Alert SA06-258A
Microsoft Internet Explorer ActiveX Vulnerability
Original release date: September 15, 2006
Last revised: --
Source: US-CERT
Systems Affected
* Microsoft Windows
* Internet Explorer
Overview
A vulnerability in ActiveX and Internet Explorer could allow an
attacker to take control of your computer.
Solution
Microsoft has not yet released an update to address this
vulnerability. From Microsoft Security Advisory (925444):
We are currently investigating the issue to determine the
appropriate course of action for customers. We will include the
fix for this issue in an upcoming security bulletin.
Until an update is available, consider the following best
practices.
Disable ActiveX
Disabling ActiveX will prevent exploitation of this and other
ActiveX vulnerabilities. Instructions for disabling ActiveX in
the Internet Zone can be found in "Securing Your Web Browser" and
"4 steps to help ward off hackers and attackers."
Do not follow unsolicited links
Do not click on unsolicited URLs, including those received in
email, instant messages, web forums, or internet relay chat (IRC)
channels.
Description
An attacker could exploit a vulnerability in an ActiveX control
by convincing a user to visit a web site with Internet
Explorer. The attacker could then take any action as the user,
including installing malicious software and accessing sensitive
personal information.
For more technical information, see Vulnerability Note VU#377369.
References
* Securing Your Web Browser -
<http://www.us-cert.gov/reading_room/securing_browser/>
* Vulnerability Note VU#377369 -
<http://www.kb.cert.org/vuls/id/377369>
* Vulnerability Note VU#377369 -
<http://www.kb.cert.org/vuls/id/377369>
* Microsoft Security Advisory (925444) -
<http://www.microsoft.com/technet/security/advisory/925444.mspx>
* 4 steps to help ward off hackers and attackers -
<http://www.microsoft.com/athome/security/online/browsing_safety.mspx>
* Microsoft Security Essentials -
<http://www.microsoft.com/protect/>
____________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/alerts/SA06-258A.html>
____________________________________________________________________
Feedback can be directed to US-CERT. Please send email to
<cert@cert.org> with "SA06-258A Feedback VU#377369" in the subject.
____________________________________________________________________
Mailing list information:
<http://www.us-cert.gov/cas/>
____________________________________________________________________
Produced 2006 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
September 15, 2006: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iQEVAwUBRQsBh+xOF3G+ig+rAQIgYgf+Jn4spjxVeJVhQ+sRE/nCWG3uHc2WvZ2D
fUc9yu5kvqS4rtzILznyCDl3NbB7K5ge5ye4tB4vfEfAafg7KukGHSsheZxQDJ5j
oXB+7tHke7ci28eKl4wmYHl0DwBLApgEAZ+iTXacTnL0jXvYM4M7gO794eW6JE16
LTD2PeMtThuEMg8UkKXWQ2J6zHVWnPfe9m4s3hCxC3nmhBuGDctY3lhoRuUGhz8M
XjEz7ccmAGJCGPO833c1aeoEQSj6IlOqqmw8iObtAjhm5lQyKz3kTi9rCtE5WcKS
x9VKxKqSHguy7LX8i9GZto1dJlnVus7PnfA86tCWjFMb9CHCRaP6nw==
=jyB0
-----END PGP SIGNATURE-----
