=====================================================================
                                    CERT-Renater

                         Note d'Information No. 2008/VULN275
_____________________________________________________________________

DATE                      : 08/07/2008

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running Microsoft Office Access 

                                  2000, Microsoft Office Access XP,
                                  Microsoft Office Access 2003,
                                  Microsoft Office Snapshot Viewer.

======================================================================

                    National Cyber Alert System

             Technical Cyber Security Alert TA08-189A


Microsoft Office Snapshot Viewer ActiveX Vulnerability

    Original release date: July 7, 2008
    Last revised: --
    Source: US-CERT


Systems Affected

      * Microsoft Office Access 2000
      * Microsoft Office Access XP
      * Microsoft Office Access 2003
      * Microsoft Office Snapshot Viewer


Overview

    An unpatched vulnerability in the Microsoft Office Snapshot Viewer 
ActiveX
    control is being used in attacks.


I. Description

    Microsoft has released Security Advisory (955179) to describe 
attacks on a
    vulnerability in the Microsoft Office Snapshot Viewer ActiveX control.
    Because no fix is currently available for this vulnerability, please 
see the
    Security Advisory and US-CERT Vulnerability Note VU#837785 for 
workarounds.


II. Impact

    A remote, unauthenticated attacker could execute arbitrary code.


III. Solution

Apply workarounds

    Microsoft  has provided workarounds for this vulnerability in Security
    Advisory  (955179). Additional details and workarounds are provided in
    US-CERT Vulnerability Note VU#837785.

    The most effective workaround for this vulnerability is to set kill 
bits for
    the Snapshot Viewer ActiveX control, as outlined in the documents noted
    above. Other workarounds include disabling ActiveX, as specified in the
    Securing Your Web Browser document, and upgrading to Internet 
Explorer 7,
    which can help mitigate the vulnerability with its ActiveX opt-in 
feature.


IV. References

      * US-CERT Vulnerability Note VU#837785 -
        <http://www.kb.cert.org/vuls/id/837785>

      * Microsoft Security Advisory (955179) -
        <http://www.microsoft.com/technet/security/advisory/955179.mspx>

      * Securing Your Web Browser -
        <http://www.us-cert.gov/reading_room/securing_browser/>


  ____________________________________________________________________

    The most recent version of this document can be found at:

      <http://www.us-cert.gov/cas/techalerts/TA08-189A.html>
  ____________________________________________________________________

    Feedback can be directed to US-CERT Technical Staff. Please send
    email to <cert@cert.org> with "TA08-189A Feedback VU#837785" in the
    subject.
  ____________________________________________________________________

    For instructions on subscribing to or unsubscribing from this
    mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
  ____________________________________________________________________

    Produced 2008 by US-CERT, a government organization.

    Terms of use:

      <http://www.us-cert.gov/legal.html>
  ____________________________________________________________________


Revision History

    July 7, 2008: Initial release


======================================================================

           =========================================================
           Les serveurs de référence du CERT-Renater
           http://www.urec.fr/securite
           http://www.cru.fr/securite
           http://www.renater.fr
           =========================================================
           + CERT-RENATER          | tel : 01-53-94-20-44          +
           + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
           + 75013 Paris           | email: certsvp@renater.fr     +
           =========================================================