Home > Microsoft Visual > Kb926857

Kb926857

Contents

In all cases, however, an attacker would have no way to force users to visit these Web sites. Known limitations & technical details User agreement, disclaimer and privacy statement About & Contact Feedback CVE is a registred trademark of the MITRE Corporation and the authoritative source The Restricted sites zone helps mitigate attacks that could try to exploit this vulnerability by preventing Active Scripting and ActiveX controls from being used when reading HTML e-mail messages. For more information on best practices on redistributed component use, please see Microsoft Knowledge Base Article 835322 and Isolated Applications and Side-by-side Assemblies.

For more information about Group Policy, visit the following Microsoft Web sites: Group Policy collection What is Group Policy Object Editor? Titled "Vulnerabilities in GDI Could Allow Remote Code Execution (956802)", this bulletin is rated critical for all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or in an Instant Messenger request When this security bulletin was issued, had this vulnerability been publicly disclosed? No.

Kb926857

Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. When this security bulletin was issued, had this vulnerability been publicly disclosed? No. Partners Careers Language Login Products + Support & Services Company + How to Buy English Deutsch Français Español 简体中文 繁體中文 日本語 Nessus Cloud Support Portal How to Buy Products Partners

However, customers may be at risk via third-party applications that distribute and use mswinsck.ocx. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. What does the update do? The update removes the vulnerability by validating stream lengths of AVI files parsed by the ActiveX control.

The article also documents recommended solutions for these issues. Cve-2008-3704 However, best practices strongly discourage allowing this. See also Managing Internet Explorer Enhanced Security Configuration. In all cases, however, an attacker would have no way to force users to visit these Web sites.

Therefore, any systems where Internet Explorer is used frequently, such as workstations or terminal servers, are at the most risk from this vulnerability. The Restricted sites zone helps mitigate attacks that could try to exploit this vulnerability by preventing Active Scripting and ActiveX controls from being used when reading HTML e-mail messages. It should be a priority for customers who have older releases of the software to migrate to supported releases to prevent potential exposure to vulnerabilities. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly.

Cve-2008-3704

Impact of workaround. For more information about Group Policy, visit the following Microsoft Web sites: Group Policy collection What is Group Policy Object Editor? Kb926857 By default, Internet Explorer on Windows Server 2003 and Windows Server 2008 runs in a restricted mode that is known as Enhanced Security Configuration. Msmask32.ocx Download When you call, ask to speak with the local Premier Support sales manager.

For more information about Group Policy, visit the following Microsoft Web sites: Group Policy collection What is Group Policy Object Editor? Users are prompted by the Information Bar before they can instantiate a previously installed ActiveX control that has not yet been used on the Internet. Paste the following text in a text editor such as Notepad. By default, Internet Explorer on Windows Server 2003 and Windows Server 2008 runs in a restricted mode that is known as Enhanced Security Configuration.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? No. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality: Prevent DataGrid ActiveX Control from running in Internet Explorer You can disable attempts to instantiate Does this mitigate this vulnerability? This mode sets the security level for the Internet zone to High.

How to undo the workaround. When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? No. Microsoft Windows Knowledge Base Article 932349 update is not installed (WinMs08kb932349Update) Vuln ID: 46190 Risk Level: High WinMs08kb932349Update Platforms: Microsoft Project: 2007, Microsoft Project: 2003 SP3, Microsoft Visual Studio .NET: 2002

It could also be possible to display specially crafted Web content by using banner advertisements or by using other methods to deliver Web content to affected systems.

Security Advisories and Bulletins Security Bulletins 2008 2008 MS08-070 MS08-070 MS08-070 MS08-078 MS08-077 MS08-076 MS08-075 MS08-074 MS08-073 MS08-072 MS08-071 MS08-070 MS08-069 MS08-068 MS08-067 MS08-066 MS08-065 MS08-064 MS08-063 MS08-062 MS08-061 MS08-060 MS08-059 In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. This article also shows you how to create a Compatibility Flags value in the registry to prevent a COM object from being instantiated in Internet Explorer. Microsoft received information about this vulnerability through responsible disclosure.

What should I do? The affected software listed in this bulletin have been tested to determine which releases are affected. Windows Common AVI Parsing Overflow Vulnerability - CVE-2008-4255 A remote code execution vulnerability exists in the Windows Common ActiveX Control for Visual Basic 6. FlexGrid Control Memory Corruption Vulnerability - CVE-2008-4253 A remote code execution vulnerability exists in the FlexGrid ActiveX Control for Visual Basic 6. These Web sites could contain specially crafted content that could exploit this vulnerability.

FAQ for Windows Common AVI Parsing Overflow Vulnerability - CVE-2008-4255 What is the scope of the vulnerability? This is a remote code execution vulnerability. Web sites that require the Windows Common AVI ActiveX Control may no longer function correctly. How could an attacker exploit the vulnerability? An attacker could exploit the vulnerability by hosting a specially crafted Web site that is designed to invoke the ActiveX control through Internet Explorer. Use Registry Editor at your own risk.

This is a mitigating factor for Web sites that you have not added to the Internet Explorer Trusted sites zone. In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. The Microsoft Visual Basic Datagrid ActiveX control could allow a remote attacker to execute arbitrary code on the system.

Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Mitigating Factors for Windows Common AVI Parsing Overflow Vulnerability - CVE-2008-4255 Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity Paste the following text in a text editor such as Notepad. TechNet Products Products Windows Windows Server System Center Browser   Office Office 365 Exchange Server   SQL Server SharePoint Products Skype for Business See all products » IT Resources Resources Evaluation