Update Protection against Microsoft Internet Explorer Access ActiveX Controls Remote Code Execution Vulnerability (MS10-044)
| Check Point Reference: | CPAI-2010-217 | |
| Date Published: | ||
| Severity: | ||
| Last Updated: | ||
| Source: | Microsoft Security Bulletin MS10-044 | |
| Industry Reference(s): | CVE-2010-0814 | |
| Protection Provided by: |
Security Gateway
|
|
| Who is Vulnerable? Microsoft Office 2003 SP3
Microsoft Office System 2007 SP1
Microsoft Office System 2007 SP2
| ||
| Vulnerability Description A remote code execution vulnerability exists in Access ActiveX controls due to the way that multiple ActiveX controls are loaded by Internet Explorer. A remote attacker could exploit this issue by convincing a user to open a maliciously crafted HTML file with Internet Explorer, which may allow the attacker to execute arbitrary code on the affected system. |
||
|
Update/Patch Available Apply patches: Microsoft Security Bulletin MS10-044 |
|
|
Vulnerability Details The vulnerability is due to the way that Internet Explorer handles memory allocation when instantiating a succession of Access ActiveX controls. To trigger this issue, an attacker may create a malicious web page that contains a succession of Access ActiveX controls and persuade a user to view it. Successful exploitation of this vulnerability will allow an attacker to take complete control of the affected system. |
Protection Overview
This protection will detect and block attempts to exploit this vulnerability.
In order for the protection to be activated, update your Security Gateway/VPN-1 product to the latest IPS/SmartDefense update. For information on how to update IPS/SmartDefense,go to SBP-2006-05, Protection tab and select the version of your choice.
To configure the defense, select your product from the list below and follow the related protection steps.