Woody Leonhard’s no-bull news, tips and help for Windows and Office
RSS icon Email icon Home icon
  • Yet Another Internet Explorer/ActiveX 0day

    Posted on July 7th, 2009 at 18:41 woody 6 comments

    If you use Internet Explorer 6 or 7 on Windows XP, you can get infected by simply visiting a Web site, thanks to another bad hole in a Microsoft ActiveX control known as the Video ActiveX control.

    Those using IE 8 or Vista apparently aren’t affected.

    The Video Control is “the main component that Microsoft Windows Media Center uses to build filter graphs for recording and playing television video.”

    As far as I can tell, the problem was first identified way back in 2007 by Hustle Labs. The Common Vulnerabilities and Exposures identification number CVE 2008-0015, which Microsoft uses to describe the hole, links to a vulnerability first reserved in December, 2007.

    The solution? You can run Microsoft’s Fixit patch, described in Security Advisory 972890.

    Or you can surf with Firefox, Chrome, or anything but Internet Explorer.

    Sound familiar?

    No idea when MS will come up with a permanent solution.

     

    6 responses to “Yet Another Internet Explorer/ActiveX 0day”

    1. Thanks. Can we wait on the Fixit patch and just stay with the Firefox, which I like?

    2. It’s nice to be able to run this Fixit as a downloaded application. Previous Fixits required running the process through the browser, and security considerations often prevented this. This one downloaded and ran within my security configuration with no problems. Nice to see Microsoft finally getting it about workarounds.

    3. Absolutely. As long as you’re using Firefox or Chrome, you’re safe.

    4. Woody’s “Absolutely” should be read as referring to Sanda’s comment, not mine.

    5. Hi. Please address the new Windows Secrets
      idea of OpenDNS for safe surfing. It’s totally confusing to me. Would Firefox do as well?

    6. And doesn’t the new AVG8.5Free address that with its little symbols of “safe” when googling, next to items listed? What am I missing? (I’m never the only one.)

    Leave a reply