Signature Detail

HTTP: Microsoft DebugDiag CrashHangExt.dll Unsafe ActiveX Control

This signature detects attempts to use an unsafe ActiveX control in Microsoft DebugDiag. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Microsoft DebugDiag 'CrashHangExt.dll' ActiveX control is prone to a denial-of-service vulnerability because of a NULL-pointer dereference error. A successful attack allows a remote attacker to crash the application using the ActiveX control (typically Internet Explorer), denying further service to legitimate users. Microsoft DebugDiag 1.0 is vulnerable; other versions may also be affected.

Affected Products

• Microsoft DebugDiag 1.0

References

• BugTraq: 31996
• CVE: CVE-2008-4800