This application requires Javascript for optimal performance.

MS.MSDA.ActiveX.Remote.Code.Execution

Release Date

Feb 10, 2010

Severity

high

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Description

This indicates an attack attempt to exploit a memory-corruption vulnerability
in the IE framework.

The vulnerability is in an ActiveX control that is part of Microsoft Data Analyzer 3.5. It may allow remote attackers to execute arbitrary code in the context of the application using the affected ActiveX control. Failed exploit attempts will likely cause the program to crash, resulting in a denial-of-service condition.

Affected Products

Microsoft Windows 2000 Service Pack 4
Windows XP Service Pack 2 and Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2
Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 x64 Edition
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for Itanium-based Systems

Recommended Actions

Disable this ActiveX Control by setting its kill bit. The CLSID is:
E0ECA9C3-D669-4EF4-8231-00724ED9288F

Please refer to the following web site on how to set kill bits:
http://support.microsoft.com/kb/240797

Coverage

IPS
VCM

Common Vulnerabilities and Exposures (CVE)

CVE-2010-0252

Reference/s

http://www.microsoft.com/technet/security/Bulletin/MS10-008.mspx (MS-ID)
http://www.microsoft.com/technet/security/Bulletin/MS10-034.mspx (MS-ID)
http://www.securityfocus.com/bid/38045 (BugTraq)

Reference: VID-18208