HTTP: MS Rich TextBox Unsafe ActiveX Control

This signature detects attempts to use unsafe ActiveX controls in Microsoft MSRICH textbox. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Mircrosoft Rich TextBox Control is prone to a vulnerability that allows attackers to create or overwrite arbitrary data with the privileges of the application using the control (typically Internet Explorer). Successful exploits will compromise affected computers or cause denial-of-service conditions; other attacks are possible. This issue affects 'richtx32.ocx' 6.1.97.82; other versions may also be affected. NOTE: This BID is being retired because the issue is not exploitable. The ActiveX control is not marked 'Safe for Scripting'.

Affected Products

Microsoft rich_textbox_control

References

BugTraq: 27201

CVE: CVE-2008-0237

Short Name

HTTP:STC:ACTIVEX:RICHTXT

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: MS Rich TextBox Unsafe ActiveX Control

Extended Description

Affected Products

References

Found a potential security threat?