Full Disclosure mailing list archives
Extremely critical Windows XMLHTTP ActiveX 0-day reported
From: Juha-Matti Laurio <juha-matti.laurio () netti fi>
Date: Sun, 5 Nov 2006 02:31:43 +0200 (EET)
To share information released via MS advisory during the weekend: More information is available at Microsoft Security Advisory #927892 "Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution" http://www.microsoft.com/technet/security/advisory/927892.mspx some workarounds listed and "ActiveX - reason of the newest Windows 0-day, again" http://blogs.securiteam.com/?p=717 This code execution vulnerability is target of active exploitation already. Reportedly the problem is that setRequestHeader() cant handle HTTP requests correctly. The vulnerable component is XMLHTTP 4.0 ActiveX Control, part of Microsoft XML Core Services 4.0. As a ActiveX issue it triggers with MSIE (probably IE6 and IE7 are both affected). - Juha-Matti _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Extremely critical Windows XMLHTTP ActiveX 0-day reported Juha-Matti Laurio (Nov 04)