Updated on Monday, July 13 at 4:03 p.m. EST
Microsoft again is dealing with a zero-day ActiveX exploit, the company disclosed Monday.
The latest bug resides in the Spreadsheet ActiveX control in Office Web Components, according to an advisory. It is being exploited in the wild, enabling cybercriminals to attain the same user rights as the local user, though Microsoft did not detail how widespread attacks have been.
It affects a number of software versions, including Office XP and 2003 Service Pack (SP) 3 and Internet Security and Acceleration Server 2004 SP3 and 2006.
Microsoft has previously discouraged the use of the affected ActiveX control -- it was unclear why, based on the advisory, but experts doubt it was because of an imminent security problem. As users await a permanent fix, they are encouraged to apply a workaround, which prevents the Office Web Components Library from running in Internet Explorer.
"Although the Microsoft Office Web Components ActiveX control has been deprecated for some time now, we still recommend customers implement the workarounds as provided in the advisory," wrote Dave Forstrom, a security response group manager, Monday on a company blog.
This is the second time in a week that a zero-day ActiveX issue has cropped up. Last Monday, Microsoft warned of active exploits taking advantage of a Video ActiveX control to launch drive-by attacks. A fix for the vulnerability, which Microsoft knew about for more than a year, is expected to arrive Tuesday as part of the software giant's monthly security update.
Andrew Storms, director of security operations at networking security firm nCircle, said Monday that ActiveX controls are preferred means of spreading malware because victims are more likely to install a plug-in than an executable.
"It's easier to get the user to accept and install and run that because it's something inside the browser," he told SCMagazineUS.com. [ActiveX controls] run as the user that you're logged in as. If you could gain remote control over that, you're essentially acting as that user."
Forstrom said Microsoft plans to release a patch for the vulnerability once engineers are confident they have created a fix that is appropriate for "broad distribution."
As a result of a number of active exploits, the Sans Internet Storm Center upgraded its Infocon threat level status to orange, one up from its normal level, for 24 hours.
Storms said users should worry more about last week's reported ActiveX flaw because it does not require any user interaction to be exploited.
"You didn't even get a pop-up or request to do anything," he said. "You've just been infected.
Microsoft again is dealing with a zero-day ActiveX exploit, the company disclosed Monday.
The latest bug resides in the Spreadsheet ActiveX control in Office Web Components, according to an advisory. It is being exploited in the wild, enabling cybercriminals to attain the same user rights as the local user, though Microsoft did not detail how widespread attacks have been.
It affects a number of software versions, including Office XP and 2003 Service Pack (SP) 3 and Internet Security and Acceleration Server 2004 SP3 and 2006.
Microsoft has previously discouraged the use of the affected ActiveX control -- it was unclear why, based on the advisory, but experts doubt it was because of an imminent security problem. As users await a permanent fix, they are encouraged to apply a workaround, which prevents the Office Web Components Library from running in Internet Explorer.
"Although the Microsoft Office Web Components ActiveX control has been deprecated for some time now, we still recommend customers implement the workarounds as provided in the advisory," wrote Dave Forstrom, a security response group manager, Monday on a company blog.
This is the second time in a week that a zero-day ActiveX issue has cropped up. Last Monday, Microsoft warned of active exploits taking advantage of a Video ActiveX control to launch drive-by attacks. A fix for the vulnerability, which Microsoft knew about for more than a year, is expected to arrive Tuesday as part of the software giant's monthly security update.
Andrew Storms, director of security operations at networking security firm nCircle, said Monday that ActiveX controls are preferred means of spreading malware because victims are more likely to install a plug-in than an executable.
"It's easier to get the user to accept and install and run that because it's something inside the browser," he told SCMagazineUS.com. [ActiveX controls] run as the user that you're logged in as. If you could gain remote control over that, you're essentially acting as that user."
Forstrom said Microsoft plans to release a patch for the vulnerability once engineers are confident they have created a fix that is appropriate for "broad distribution."
As a result of a number of active exploits, the Sans Internet Storm Center upgraded its Infocon threat level status to orange, one up from its normal level, for 24 hours.
Storms said users should worry more about last week's reported ActiveX flaw because it does not require any user interaction to be exploited.
"You didn't even get a pop-up or request to do anything," he said. "You've just been infected.
