HTTP: Microsoft Internet Explorer Speech API 4 Dangerous ActiveX

This signature detects attempts to exploit a known vulnerability in Internet Explorer (IE). An attacker can create a malicious Web page containing dangerous ActiveX CLSID references, which if accessed by a victim, can allow the attacker to gain control of the victim's client browser.

Extended Description

Microsoft Internet Explorer is prone to multiple buffer-overflow vulnerabilities when instantiating certain COM objects. An attacker may exploit these issues by enticing victims into opening a maliciously crafted webpage. Successfully exploiting these issues allows remote attackers to execute arbitrary machine code in the context of the affected application, facilitating the remote compromise of affected computers.

Affected Products

Avaya messaging_application_server,Microsoft internet_explorer

References

BugTraq: 24426

CVE: CVE-2007-2222

URL: http://securityreason.com/exploitalert/3356

Short Name

HTTP:STC:ACTIVEX:SPEECH-API

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Internet Explorer Speech API 4 Dangerous ActiveX

Extended Description

Affected Products

References

Found a potential security threat?