It’s Patch Tuesday, but Microsoft didn’t discover the latest zero-day vulnerability quickly enough to issue a fix this week. On Monday, Microsoft issued a security advisory about a new vulnerability in the Office Web Components Spreadsheet ActiveX control.
“The vulnerability exists specifically in the Spreadsheet ActiveX Control and could allow an attacker who successfully exploited this vulnerability the same user rights as the local user,” advisory said. “We are aware of limited, active attacks attempting to exploit this vulnerability.”
Browse and Get Owned
According to Microsoft, this vulnerability could be used for remote code execution in a “browse and get owned” scenario. User interaction is required, since a user needs to go to a malicious Web site that hosts the exploit.
“The last couple of weeks have been interesting for anybody following Microsoft security,” said Wolfgang Kandek, CTO of Qualys. “Beyond the DirectShow vulnerability zero day at the end of May, Microsoft has been forced to acknowledge two other zero-day vulnerabilities.”
Kandek noted that both are related to ActiveX. The first vulnerability was discovered in a video component. Since Internet Explorer browsing of Web sites with exploit code embedded is the main attack vector, Kandek said it would certainly fuel the discussion about the use of alternative browsers.
“Microsoft has quickly provided easy-to-use workarounds for both vulnerabilities via their Fixit program,” he said, “but it is not clear why they have waited for over a year to provide a fix for the underlying coding problems which they were notified of in the spring of 2008.”
Plugging ActiveX Holes
Last week, Microsoft issued a security advisory about a vulnerability in its Video ActiveX Control. Microsoft issued a patch Tuesday to plug two critical Windows security holes related to ActiveX.
The updates will plug a zero-day vulnerability within Microsoft TV Technologies that can be exploited through Internet Explorer. Microsoft TV…