Microsoft XMLHTTP ActiveX Control Code Execution Vulnerability

[Richard1]

Just wanted to pass this along, it can affect Windows 2000, Windows XP Service Pack 2 and Windows Server 2003. Here's a blurb from Secunia:

"Description: A vulnerability has been reported in Microsoft XML Core Services, which can be exploited by malicious people to compromise a users system.

The vulnerability is caused due to an unspecified error in the XMLHTTP 4.0 ActiveX Control.

Successful exploitation allows execution of arbitrary code when a user e.g. visits a malicious website using Internet Explorer.

NOTE: The vulnerability is already being actively exploited.

Solution: Microsoft has recommended various workarounds including setting the kill-bit for the affected ActiveX control (see the vendor's advisory for details)."

Fun, fun, fun.

[NooNoo]

here is the Microsoft response which includes scenarios on how this attack would work and how to mitigate such an attack.