HTTP: Internet Explorer: Local Troubleshooter Query Overflow

This signature detects attempts to exploit a known vulnerability against an ActiveX control in Microsoft Outlook. The Local Troubleshooter ActiveX control has inadequate bounds for checking for its Query function; this exploit bypasses normal Outlook/IE ActiveX security controls. Attackers can create a malicious Web site that contains a call to this ActiveX control; this call contains an overly long string that overflows the control buffer, enabling the attacker to gain control of the target system with user privileges.

Extended Description

Buffer overflow in Troubleshooter ActiveX Control (Tshoot.ocx) in Microsoft Windows 2000 SP4 and earlier allows remote attackers to execute arbitrary code via an HTML document with a long argument to the RunQuery2 method.

Affected Products

Microsoft windows_2000

References

BugTraq: 8833

CVE: CVE-2003-0662

URL: http://www.microsoft.com/technet/security/Bulletin/MS03-042.mspx

Short Name

HTTP:STC:ACTIVEX:TROUBLE-QUERY

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Internet Explorer: Local Troubleshooter Query Overflow

Extended Description

Affected Products

References

Found a potential security threat?