SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Database)  >   Microsoft Access Vendors:   Microsoft
(US-CERT Issues Advisory) Microsoft Access Snapshot Viewer ActiveX Control Lets Remote Users Download Files to Arbitrary Locations
SecurityTracker Alert ID:  1020434
SecurityTracker URL:  http://securitytracker.com/id/1020434
CVE Reference:   CVE-2008-2463   (Links to External Site)
Updated:  Aug 12 2008
Original Entry Date:  Jul 8 2008
Impact:   Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2000, 2002, 2003
Description:   A vulnerability was reported in Microsoft Access in the Snapshot Viewer ActiveX control. A remote user can cause arbitrary code to be downloaded and then later executed on the target user's system.

A remote user can create specially crafted HTML that, when loaded by the target user, will invoke the 'snapview.ocx' ActiveX control and download arbitrary files to arbitrary locations on the target user's system. The files can then be subsequently executed.

The CLSIDs of the vulnerable control are: F0E42D50-368C-11D0-AD81-00A0C90DC8D9, F0E42D60-368C-11D0-AD81-00A0C90DC8D9, and F2175210-368C-11D0-AD81-00A0C90DC8D9

Microsoft Office Access 2000, Microsoft Office Access 2002, and Microsoft Office Access 2003 are affected.

Snapshot Viewer for Microsoft Access is affected.

This vulnerability is being actively exploited.

Impact:   A remote user can create HTML that, when loaded by the target user, will download files to the target user's system. The files can then be later executed.
Solution:   The vendor has issued the following fixes:

Microsoft Office Access 2000 Service Pack 3:

http://www.microsoft.com/downloads/details.aspx?familyid=54e4031d-298f-480c-88d5-0ad3b2b62ba9

Microsoft Office Access 2002 Service Pack 3:

http://www.microsoft.com/downloads/details.aspx?familyid=34b655f8-1922-4246-94ca-ed381c3e3b13

Microsoft Office Access 2003 Service Pack 2 and Microsoft Office Access 2003 Service Pack 3:

http://www.microsoft.com/downloads/details.aspx?familyid=fd698517-a504-427d-9e5f-fde8f102142c

A restart is not required.

The Microsoft advisory is available at:

http://www.microsoft.com/technet/security/bulletin/ms08-041.mspx

US-CERT had previously issued an advisory containing workaround recommendations:

http://www.kb.cert.org/vuls/id/837785

Vendor URL:  www.microsoft.com/technet/security/bulletin/ms08-041.mspx (Links to External Site)
Cause:   Access control error
Underlying OS:  Windows (Any)

Message History:   This archive entry is a follow-up to the message listed below.
Jul 7 2008 Microsoft Access Snapshot Viewer ActiveX Control Lets Remote Users Download Files to Arbitrary Locations



 Source Message Contents

Subject:  US-CERT Technical Cyber Security Alert TA08-189A -- Microsoft Office Snapshot Viewer ActiveX Vulnerability



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

                   National Cyber Alert System

            Technical Cyber Security Alert TA08-189A


Microsoft Office Snapshot Viewer ActiveX Vulnerability

   Original release date: July 7, 2008
   Last revised: --
   Source: US-CERT


Systems Affected

     * Microsoft Office Access 2000
     * Microsoft Office Access XP
     * Microsoft Office Access 2003
     * Microsoft Office Snapshot Viewer


Overview

   An unpatched vulnerability in the Microsoft Office Snapshot Viewer ActiveX
   control is being used in attacks.


I. Description

   Microsoft has released Security Advisory (955179) to describe attacks on a
   vulnerability in the Microsoft Office Snapshot Viewer ActiveX control.
   Because no fix is currently available for this vulnerability, please see the
   Security Advisory and US-CERT Vulnerability Note VU#837785 for workarounds.


II. Impact

   A remote, unauthenticated attacker could execute arbitrary code.


III. Solution

Apply workarounds

   Microsoft  has provided workarounds for this vulnerability in Security
   Advisory  (955179). Additional details and workarounds are provided in
   US-CERT Vulnerability Note VU#837785.

   The most effective workaround for this vulnerability is to set kill bits for
   the Snapshot Viewer ActiveX control, as outlined in the documents noted
   above. Other workarounds include disabling ActiveX, as specified in the
   Securing Your Web Browser document, and upgrading to Internet Explorer 7,
   which can help mitigate the vulnerability with its ActiveX opt-in feature.


IV. References

     * US-CERT Vulnerability Note VU#837785 -
       <http://www.kb.cert.org/vuls/id/837785>

     * Microsoft Security Advisory (955179) -
       <http://www.microsoft.com/technet/security/advisory/955179.mspx>

     * Securing Your Web Browser -
       <http://www.us-cert.gov/reading_room/securing_browser/>


 ____________________________________________________________________

   The most recent version of this document can be found at:

     <http://www.us-cert.gov/cas/techalerts/TA08-189A.html>
 ____________________________________________________________________

   Feedback can be directed to US-CERT Technical Staff. Please send
   email to <cert@cert.org> with "TA08-189A Feedback VU#837785" in the
   subject.
 ____________________________________________________________________

   For instructions on subscribing to or unsubscribing from this
   mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
 ____________________________________________________________________

   Produced 2008 by US-CERT, a government organization.

   Terms of use:

     <http://www.us-cert.gov/legal.html>
 ____________________________________________________________________


Revision History

   July 7, 2008: Initial release




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iQEVAwUBSHJ0D3IHljM+H4irAQI4/gf9GMgKMgFwrFpwXqtkcESdNuOqHHBU2z57
tRdKpqpZL0nRY11z5FEx2wBK56/GBYVBn5pGjH9/LpWnbvsqVdt3wePgXHhbAJYW
GMhZj4JKa+313sTszdrEUmTZK8gK+QZtx2V3+rSVNhMbnQHVUYxevjUtNGrI5Sni
iITq9GVJX7GIQb3aI+uFaxScWD84tf9rnUqP71SmapWvaz5rnTdPH/QPLZtpcoT8
Nw/uQAzekHUfvqbvkUdud39X4IOJKz2Vi10r3QC+gdkHCrNaXtM2RoIfkU9+B3f4
91SBnJpmhwgifILsll9WHHvYATZScUWINUkMMA/vpBXHNxMmXP+7XQ==
=lT3a
-----END PGP SIGNATURE-----

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC