Signature Detail

HTTP: Microsoft WMI Administrative Tool Unsafe ActiveX Control

This signature detects attempts to use unsafe ActiveX controls in Microsoft WMI Administrative Tool. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Microsoft WMI Administrative Tools is prone to a remote code-execution vulnerability that affects the WMI Object Viewer ('WBEMSingleView.ocx') ActiveX control. An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage. Successful exploits will allow the attacker to execute arbitrary code within the context of the application (typically Internet Explorer) that uses the ActiveX control. Microsoft WMI Administrative Tools 1.1 is vulnerable; other versions may also be affected.

Affected Products

• Avaya aura_conferencing 6.0 SP1 Standard
• Avaya aura_conferencing 6.0 Standard
• Avaya callpilot 4.0
• Avaya callpilot 5.0
• Avaya communication_server_1000_telephony_manager 3.0
• Avaya communication_server_1000_telephony_manager 4.0
• Avaya meeting_exchange 5.0
• Avaya meeting_exchange 5.0.0.0.52
• Avaya meeting_exchange 5.0 SP1
• Avaya meeting_exchange 5.0 SP2
• Avaya meeting_exchange 5.1
• Avaya meeting_exchange 5.1 SP1
• Avaya meeting_exchange 5.2
• Avaya meeting_exchange 5.2 SP1
• Avaya meeting_exchange 5.2 SP2
• Avaya meeting_exchange-client_registration_server
• Avaya meeting_exchange-recording_server
• Avaya meeting_exchange-streaming_server
• Avaya meeting_exchange-web_conferencing_server
• Avaya meeting_exchange-webportal
• Avaya messaging_application_server 4
• Avaya messaging_application_server 5
• Microsoft windows_xp - Gold 64-Bit-2002
• Microsoft windows_xp Gold Embedded
• Microsoft windows_xp - Gold Home
• Microsoft windows_xp Gold Media Center
• Microsoft windows_xp Gold Professional
• Microsoft windows_xp Gold Tablet Pc
• Microsoft windows_xp - Gold X64
• Microsoft windows_xp - Sp1 X64
• Microsoft windows_xp
• Microsoft windows_xp
• Microsoft windows_xp_64-bit_edition SP1
• Microsoft windows_xp_64-bit_edition
• Microsoft windows_xp_64-bit_edition_version_2003 SP1
• Microsoft windows_xp_64-bit_edition_version_2003
• Microsoft windows_xp_embedded SP1
• Microsoft windows_xp_embedded SP2
• Microsoft windows_xp_embedded SP3
• Microsoft windows_xp_embedded
• Microsoft windows_xp_embedded_sp2_feature_pack_2007
• Microsoft windows_xp_gold
• Microsoft windows_xp_home SP1
• Microsoft windows_xp_home SP2
• Microsoft windows_xp_home SP3
• Microsoft windows_xp_home
• Microsoft windows_xp_media_center_edition SP1
• Microsoft windows_xp_media_center_edition SP2
• Microsoft windows_xp_media_center_edition SP3
• Microsoft windows_xp_media_center_edition
• Microsoft windows_xp_media_center_edition_2005 SP3
• Microsoft windows_xp_professional SP1
• Microsoft windows_xp_professional SP2
• Microsoft windows_xp_professional SP3
• Microsoft windows_xp_professional
• Microsoft windows_xp_professional_x64_edition SP2
• Microsoft windows_xp_professional_x64_edition
• Microsoft windows_xp_service_pack_3
• Microsoft windows_xp_tablet_pc_edition SP1
• Microsoft windows_xp_tablet_pc_edition SP2
• Microsoft windows_xp_tablet_pc_edition SP3
• Microsoft windows_xp_tablet_pc_edition
• Microsoft wmitools 1.1

References

• BugTraq: 45546
• CVE: CVE-2010-3973
• CVE: CVE-2010-4588
• URL: http://www.us-cert.gov/current/index.html#microsoft_wmi_administrative_tool_activex
• URL: http://www.kb.cert.org/vuls/id/725596