Microsoft XMLHTTP ActiveX Control Code Execution Vulnerability

Just wanted to pass this along, it can affect Windows 2000, Windows XP Service Pack 2 and Windows Server 2003. Here's a blurb from Secunia:

"Description: A vulnerability has been reported in Microsoft XML Core Services, which can be exploited by malicious people to compromise a users system.

The vulnerability is caused due to an unspecified error in the XMLHTTP 4.0 ActiveX Control.

Successful exploitation allows execution of arbitrary code when a user e.g. visits a malicious website using Internet Explorer.

NOTE: The vulnerability is already being actively exploited.

Solution: Microsoft has recommended various workarounds including setting the kill-bit for the affected ActiveX control (see the vendor's advisory for details)."

Fun, fun, fun.

here is the Microsoft response which includes scenarios on how this attack would work and how to mitigate such an attack.