Microsoft Xmlhttp Activex Control Code Execution Vulnerability Extremely critical

[sujith 0]

Another vulnerability to XP has been found by Security research firm Secunia.

 

Description:

A vulnerability has been reported in Microsoft XML Core Services, which can be exploited by malicious people to compromise a users system.

 

The vulnerability is caused due to an unspecified error in the XMLHTTP 4.0 ActiveX Control.

 

Successful exploitation allows execution of arbitrary code when a user e.g. visits a malicious website using Internet Explorer.

 

NOTE: The vulnerability is already being actively exploited.

Solution:

Microsoft has recommended various workarounds including setting the kill-bit for the affected ActiveX control

 

More Information on this

http://secunia.com/advisories/22687/

Edited November 5, 2006 by knight17 (see edit history)