classid

MS12-060: Addressing a vulnerability in MSCOMCTL.OCX’s TabStrip control

Security Research & Defense / By / June 20, 2019

Today we released MS12-060, addressing a potential remote code execution vulnerability in MSCOMCTL.OCX, the binary included with a number of Microsoft products to provide a set of common ActiveX controls. Limited, targeted attacks exploiting CVE-2012-1856 MS12-060 is on the list of high priority updates for this month for two reasons: we are aware of very …

MS12-060: Addressing a vulnerability in MSCOMCTL.OCX’s TabStrip control Read More »

MS08-041 : The Microsoft Access Snapshot Viewer ActiveX control

Security Research & Defense / By / June 20, 2019

MS08-041 fixes a vulnerability in the Microsoft Access Snapshot Viewer ActiveX control. It’s an interesting vulnerability so we wanted to go into more detail about platforms at reduced risk and also more about the servicing strategy for this vulnerability. Windows Vista at reduced risk? We first heard about this vulnerability from customers sending in reports …

MS08-041 : The Microsoft Access Snapshot Viewer ActiveX control Read More »

MS08-023: Same bug, four different security bulletin ratings

Security Research & Defense / By / June 20, 2019

Security bulletin MS08-023 addressed two ActiveX control vulnerabilities, one in a Visual Studio ActiveX control and another in a Yahoo!’s Music Jukebox ActiveX control.  The security update sets the killbit for both controls.  For more about how the killbit works, see the excellent three-part series (1, 2, 3) from early February in this blog. One interesting …

MS08-023: Same bug, four different security bulletin ratings Read More »

Not safe = not dangerous? How to tell if ActiveX vulnerabilities are exploitable in Internet Explorer

Security Research & Defense / By / June 20, 2019

In early January you may have read posts on security distribution lists regarding two ActiveX Controls released by Microsoft. We have investigated those controls and fortunately, they are not exploitable since IE does not treat them as being safe.  We wanted to give you some background on how to evaluate whether a potential vulnerability found …

Not safe = not dangerous? How to tell if ActiveX vulnerabilities are exploitable in Internet Explorer Read More »