HTTP: Microsoft XML Core Services 3.0 ActiveX Control

This signature detects attempts to exploit a known vulnerability in Microsoft XML Core Services 3.0. An attacker can create a malicious Web site containing dangerous ActiveX controls, which if accessed by a victim, allows the attacker to cause a buffer overflow and perform arbitrary remote code execution within the context of the user.

Extended Description

Microsoft XML Core Services (MSXML) is prone to a cross-domain information-disclosure vulnerability because the application fails to properly handle certain error checks. An attacker can exploit this issue to harvest potentially sensitive information from a web page in another domain. Information obtained may aid in further attacks.

Affected Products

Nortel_networks self-service_media_processing_server,Nortel_networks self-service-ccss7

References

CVE: CVE-2008-4033

URL: http://www.microsoft.com/technet/security/Bulletin/MS08-069.mspx

Short Name

HTTP:STC:ACTIVEX:XML-CORE-3-0

Severity

Major

Recommended

False

Recommended Action

None

HTTP: Microsoft XML Core Services 3.0 ActiveX Control

Extended Description

Affected Products

References

Found a potential security threat?