=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2009/VULN274
_____________________________________________________________________

DATE                      : 07/07/2009

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running Microsoft Video ActiveX Control.

======================================================================
http://www.us-cert.gov/cas/techalerts/TA09-187A.html
______________________________________________________________________

                    National Cyber Alert System

              Technical Cyber Security Alert TA09-187A


Microsoft Video ActiveX Control Vulnerability

   Original release date: July 06, 2009
   Last revised: --
   Source: US-CERT


Systems Affected

     * Microsoft Windows XP
     * Microsoft Windows Server 2003


Overview

   An unpatched vulnerability in the Microsoft Video ActiveX control
   is being used in attacks.


I. Description

   Microsoft has released Security  Advisory (972890) to describe
   attacks on a vulnerability in the Microsoft Video ActiveX  control.
   Because no fix is currently available for this vulnerability,
   please see the Security Advisory and US-CERT Vulnerability Note
   VU#180513 for workarounds.


II. Impact

   A remote, unauthenticated attacker could execute arbitrary code
   with the privileges of the victim user.


III. Solution

   Apply workarounds

   Microsoft has provided workarounds for this vulnerability in
   Security Advisory (972890). Additional details and workarounds are
   provided in US-CERT Vulnerability Note VU#180513.

   The most effective workaround for this vulnerability is to set kill
   bits for the Microsoft Video ActiveX control, as outlined in the
   documents noted above.  Other workarounds include disabling
   ActiveX, as specified in the Securing Your Web Browser document,
   and upgrading to Internet Explorer 7 or later, which can help
   mitigate the vulnerability with its ActiveX opt-in feature.


IV. References

 * US-CERT Vulnerability Note VU#180513 -
   <http://www.kb.cert.org/vuls/id/180513>

 * Microsoft Security Advisory (972890) -
   <http://www.microsoft.com/technet/security/advisory/972890.mspx>

 * Securing Your Web Browser -
   <http://www.us-cert.gov/reading_room/securing_browser/>

 ____________________________________________________________________

   The most recent version of this document can be found at:

     <http://www.us-cert.gov/cas/techalerts/TA09-187A.html>
 ____________________________________________________________________

   Feedback can be directed to US-CERT Technical Staff. Please send
   email to <cert@cert.org> with "TA09-187A Feedback VU#180513" in
   the subject.
 ____________________________________________________________________

   For instructions on subscribing to or unsubscribing from this
   mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
 ____________________________________________________________________

   Produced 2009 by US-CERT, a government organization.

   Terms of use:

     <http://www.us-cert.gov/legal.html>
 ____________________________________________________________________

Revision History

  July 06, 2009: Initial release


          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================