This site is deprecated. Please
CLICK HERE for latest updates
Short Name |
HTTP:STC:ACTIVEX:MSCOMCTL-OCX
|
Severity |
Major
|
Recommended |
No
|
Recommended Action |
Drop
|
Category |
HTTP
|
Keywords |
Microsoft Windows Common Control 'MSCOMCTL.OCX' Unsafe ActiveX Control
|
Release Date |
2012/04/09
|
Update Number |
2114
|
Supported Platforms |
idp-4.0.110090709+, isg-3.1.134269+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+
|
HTTP: Microsoft Windows Common Control 'MSCOMCTL.OCX' Unsafe ActiveX Control
This signature detects attempts to exploit a known flaw in the Microsoft Windows Common ActiveX control. An attacker could exploit the vulnerability by constructing a specially crafted Web page or sending a malicious RTF document. Visiting the website with a vulnerable version of Internet Explorer, or opening the RTF document with Office or Wordpad could result in arbitrary code execution.
Extended Description
Microsoft Windows Common Controls is prone to a remote code-execution vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage.
Successful exploits will allow the attacker to execute arbitrary code within the context of the application (typically Internet Explorer) that uses the ActiveX control.
Affected Products
- Microsoft biztalk_server_2002 SP1
- Microsoft commerce_server_2002 SP1
- Microsoft commerce_server_2002 SP2
- Microsoft commerce_server_2002 SP3
- Microsoft commerce_server_2002 SP4
- Microsoft commerce_server_2007 SP1
- Microsoft commerce_server_2007 SP2
- Microsoft commerce_server_2007
- Microsoft commerce_server_2009 R2
- Microsoft commerce_server_2009
- Microsoft office_2003 SP1
- Microsoft office_2003 SP2
- Microsoft office_2003 SP3
- Microsoft office_2003_web_components SP3
- Microsoft office_2007 SP1
- Microsoft office_2007 SP2
- Microsoft office_2010 (32-bit edition) SP1
- Microsoft office_2010
- Microsoft office_2010_(32-bit_edition)
- Microsoft sql_server_2000 SP1
- Microsoft sql_server_2000 SP2
- Microsoft sql_server_2000 SP3
- Microsoft sql_server_2000 SP4
- Microsoft sql_server_2000
- Microsoft sql_server_2005_express_edition SP1
- Microsoft sql_server_2005_express_edition SP2
- Microsoft sql_server_2005_express_edition SP3
- Microsoft sql_server_2005_express_edition SP4
- Microsoft sql_server_2005_itanium_edition SP1
- Microsoft sql_server_2005_itanium_edition SP2
- Microsoft sql_server_2005_itanium_edition SP3
- Microsoft sql_server_2005_itanium_edition SP4
- Microsoft sql_server_2005_itanium_edition
- Microsoft sql_server_2005_x64_edition SP1
- Microsoft sql_server_2005_x64_edition SP2
- Microsoft sql_server_2005_x64_edition SP3
- Microsoft sql_server_2005_x64_edition SP4
- Microsoft sql_server_2008 R2
- Microsoft sql_server_2008 R2 SP1
- Microsoft sql_server_2008
- Microsoft sql_server_2008_32-bit R2
- Microsoft sql_server_2008_32-bit SP2
- Microsoft sql_server_2008_32-bit SP3
- Microsoft sql_server_2008_itanium R2
- Microsoft sql_server_2008_itanium SP1
- Microsoft sql_server_2008_itanium SP2
- Microsoft sql_server_2008_itanium SP3
- Microsoft sql_server_2008_x64 SP2
- Microsoft sql_server_2008_x64 SP3
- Microsoft visual_basic 6.0
- Microsoft visual_basic 6.0 Runtime Extended Files
- Microsoft visual_foxpro 8.0
- Microsoft visual_foxpro 8.0 SP1
- Microsoft visual_foxpro 9.0 SP1
- Microsoft visual_foxpro 9.0 SP2
References