OSVDB ID: 24517

Title: Microsoft Data Access Components RDS.Dataspace ActiveX Remote Code Execution

Info

Disclosure
Apr 11, 2006

Discovery
Unknown

Dates

Exploit
Jul 21, 2006

Solution
Apr 11, 2006

Description

 Microsoft RDS.Dataspace ActiveX control, which is distributed with Microsoft Data Access Components, contains a flaw that may allow an attacker to execute code in the context of the user visiting a malicious web page. No further details have been provided.

Classification

 Location: Remote / Network Access, Context Dependent
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Public, Exploit Commercial
Disclosure: OSVDB Verified, Vendor Verified

Solution

 Microsoft has released a patch to address this issue. Additionally, it is possible to correct the flaw by implementing the following workaround(s): disable execution of activeX controls in Internet Explorer

Products

Microsoft Corporation

MDAC

 2.8
2.7
2.7 SP1
2.5 SP3
2.8 SP2
2.8 SP1

References

Credit
  • Golan Yosef - Finjan
  • Stefano Meller - Yarix
  • Mirko Gatto - Yarix


Direct URL: http://osvdb.org/24517