New Zero-Day Flaw Found

News of a newly discovered zero-day exploit is percolating across the Web as I type. But, while the hole is pretty serious, there's still a lot of confusion as to how many users are at risk. And to be clear, there are no attacks going on in the wild that we know of at this point.

This particular flaw is not in a piece of Microsoft software but in third-party software that Microsoft includes as part of its DirectX Media Software Developers Kit (SDK). Like many exploits we've seen lately, this is in the form of an ActiveX control ? a technology Microsoft developed in the late 90s for creating plug-ins for various programs, especially Internet Explorer.

How to get attacked? First you have to have the flawed ActiveX control on your PC. According to security researcher Secunia, this one is from Live Picture Corp. and it's called DXSurface.LivePicture.FLashPix.1 (DXTLIPI.DLL).

The U.S. Computer Emergency Readiness Team (US-CERT) says the following:

"By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user."

The most straightforward way of blocking the problem component is to set the "kill bit" in the Windows Registry for that ActiveX control. As I've said before, editing the Windows Registry is not for the faint-hearted, because a screw up could (worst case) force you to reinstall Windows and all of your applications.

Nevertheless, other than blocking execution of all ActiveX controls on your PC, that's currently your only option. For those of you that want to know more, Sunbelt Software provides a pretty readable/understandable discussion of this problem as well as pointers to other useful information from Microsoft on how to set kill bits.

That said, at the bottom of Sunbelt's discussion is the following statement:

"I don't see this as being a big issue, as it requires the DirectX SDK (not a lot of people running that)."

In fact, this software is being phased out (Microsoft uses the annoying and confusing term "deprecated") as customers move to Windows Vista. Additionally, I did several searches on my own four-year-old Windows XP system, including my external backup hard drive, and found no trace of the flawed plug-in or the affected SDK.

Comments

Post a comment Post a comment

0 / 1000 max characters