HTTP: Unsafe Microsoft Video ActiveX Control (2)

This signature detects attempts to use unsafe ActiveX components in Microsoft Windows system. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX components, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

The Microsoft Active Template Library (ATL) is prone to a remote code-execution vulnerability. This issue affects a private version of the ATL used internally by Microsoft; components written by other vendors are likely unaffected. Remote attackers can exploit this issue to execute arbitrary code with the privileges of the user running an application built against the affected library. Failed exploit attempts will result in a denial-of-service condition. NOTE: This BID was previously titled "Microsoft Windows 'MPEG2TuneRequest' ActiveX Control Remote Code Execution Vulnerability". It has been updated to better reflect the issue.

Affected Products

Nortel_networks self-service_media_processing_server,Nortel_networks communication_control_toolkit

References

BugTraq: 35558 35982 35585

CVE: CVE-2009-2494

Short Name

HTTP:STC:ACTIVEX:MSVIDCTL-2

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Unsafe Microsoft Video ActiveX Control (2)

Extended Description

Affected Products

References

Found a potential security threat?