Signature Detail

HTTP: MS Rich TextBox Unsafe ActiveX Control

This signature detects attempts to use unsafe ActiveX controls in Microsoft MSRICH textbox. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Mircrosoft Rich TextBox Control is prone to a vulnerability that allows attackers to create or overwrite arbitrary data with the privileges of the application using the control (typically Internet Explorer). Successful exploits will compromise affected computers or cause denial-of-service conditions; other attacks are possible. This issue affects 'richtx32.ocx' 6.1.97.82; other versions may also be affected. NOTE: This BID is being retired because the issue is not exploitable. The ActiveX control is not marked 'Safe for Scripting'.

Affected Products

• Microsoft Rich TextBox Control 6.0

References

• BugTraq: 27201
• CVE: CVE-2008-0237