Microsoft warns of new ActiveX flaw
Published: 14 Jul 2009 08:30 BST
Attackers are exploiting a new critical ActiveX hole in Microsoft Office to take control of PCs by luring Internet Explorer users to malicious websites, Microsoft said on Monday.
The zero-day hole, the third one announced by Microsoft in less than two months, is in Office Web Components ActiveX controls used to display and publish spreadsheets, charts and databases to the web.
It affects Office XP, Office 2003, Internet Security and Acceleration Server 2004 and 2006, as well as Office Small Business Accounting 2006.
The security advisory details a manual workaround, or people can use Microsoft's Fix-It tool to implement the workaround automatically.
Microsoft said it was working on a security update to patch the hole.
Antivirus vendor Sophos, meanwhile, said in a blog posting on its site that it had received reports of several websites, mostly in China, serving the exploit as part of a web-exploit kit that downloads and runs a Windows Executable detected as 'Mal/Generic-A'.
Credit: Microsoft warns of attacks on new ActiveX hole from CNET News
Did you find this article useful?
4 out of 4 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
Full Talkback thread
3 comments
