Zero-Day Hits Microsoft DirectShow

Microsoft today issued an advisory to its customers warning them that a new vulnerability in Microsoft Video ActiveX Control affecting Windows XP and Windows Server 2003 is currently being actively exploited. The software vendor has issued a work-around.According to security research group, CSIS, the flaw, which is within part of Microsoft DirectShow, is currently being attacked through thousands of recently compromised legitimate Web sites. The exploit code has been released and is widely available on the Internet.

Microsoft provides details on its workaround in this advisory.

The company lists the following as possible mitigating factors at avoiding compromise:

"• Customers who are using Windows Vista or Windows Server 2008 are not affected because the ability to pass data to this control within Internet Explorer has been restricted.

• By default, Internet Explorer on Windows Server 2003 and 2008 runs in a restricted mode that is known as Enhanced Security Configuration. Enhanced Security Configuration is a group of preconfigured settings in Internet Explorer that can reduce the likelihood of a user or administrator downloading and running specially crafted Web content on a server. This is a mitigating factor for Web sites that you have not added to the Internet Explorer Trusted sites zone. See also Managing Internet Explorer Enhanced Security Configuration.

• By default, all supported versions of Microsoft Outlook and Microsoft Outlook Express open HTML e-mail messages in the Restricted sites zone. The Restricted sites zone helps mitigate attacks that could try to exploit this vulnerability by preventing Active Scripting and ActiveX controls from being used when reading HTML e-mail messages. However, if a user clicks a link in an e-mail message, the user could still be vulnerable to exploitation of this vulnerability through the Web-based attack scenario.

• In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to persuade users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker's Web site.

• An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Web-based attacks involving the infiltration of legitimate Web sites to infect end users whose systems are at-risk through a client-side vulnerability are on the rise. As are phishing based attacks designed to lure users to maliciously crafted Web sites -- where the user may be infected through either clicking a link, or even automatically if there system is vulnerable.

"

Security firm Fortinet's June 2009 ThreatScape report found Web-borne malware to continue to proliferate, including the spread of various bot variants, key-stroke loggers, and Trojans.

For my mobile security and technology observations, consider following me on Twitter.