=====================================================================

                           CERT-Renater

               Note d'Information No. 2013/VULN495
_____________________________________________________________________

DATE                : 12/11/2013

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):  Systems running Internet Explorer.

======================================================================
http://blogs.technet.com/b/msrc/archive/2013/11/11/activex-control-issue-being-addressed-in-update-tuesday.aspx
______________________________________________________________________

ActiveX Control issue being addressed in Update Tuesday
Dustin C. Childs
11 Nov 2013 1:18 PM


Late last Friday, November 8, 2013, a vulnerability, CVE-2013-3918,
affecting an Internet Explorer ActiveX Control was publically
disclosed. We have confirmed that this vulnerability is an issue
already scheduled to be addressed in “Bulletin 3”, which will be
released as MS13-090, as listed in the November Advanced Notification
Service (ANS). The security update will be distributed to customers
tomorrow via Windows Update at approximately 10:00 AM PDT. Customers
who have Automatic Updates enabled will not need to take any action to
receive the update.

While we are in the process of finalizing the security update to
address this issue, we encourage Internet Explorer customers concerned
with this vulnerability to follow the following mitigations:

    Set Internet and local intranet security zone settings to "High" to
block ActiveX Controls and Active Scripting in these zones

    This action will help prevent exploitation but may affect
usability; therefore, trusted sites should be added to the Internet
Explorer Trusted Sites zone to minimize disruption.

    Configure Internet Explorer to prompt before running Active
Scripting or disable Active Scripting in the Internet and local
intranet security zones

    This action will help prevent exploitation but can affect
usability, so trusted sites should be added to the Internet Explorer
Trusted Sites zone to minimize disruption.

    Deploy the Enhanced Mitigation Experience Toolkit (EMET)

    This will help prevent exploitation by providing mitigations to
help protect against this issue and should not affect usability of
websites.

As a best practice, we always encourage customers to follow the
"Protect Your Computer" guidance of enabling a firewall, applying all
software updates and installing anti-virus and anti-spyware software.

We also encourage customers to exercise caution when visiting websites
and avoid clicking suspicious links or opening email messages from
unfamiliar senders. Additional information can be found at
www.microsoft.com/protect.

We will continue to monitor the threat landscape very closely and take
appropriate action to help protect our customers.

Thank you,
Dustin Childs
Group Manager, Response Communications
Trustworthy Computing

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================