News

Microsoft Warns of ActiveX Exploit in Access

On Monday, a day ahead of its monthly patch release, Microsoft issued a security advisory specific to its database program in Microsoft Office.

On Monday, a day ahead of its monthly patch release, Microsoft issued a security advisory specific to its database program in Microsoft Office. The exploit permits "limited targeted attacks leveraging a potential vulnerability in the ActiveX control" for certain components of Microsoft Access.

According to Security Response Communications Manager Bill Sisk, any attacker who successfully exploits this vulnerability "could gain the same user rights as the logged-on user."

Sisk said, via an e-mail, that the vulnerability affects the ActiveX control for the Snapshot Viewer in Microsoft Office Access 2000, Microsoft Office Access 2002 and Microsoft Office Access 2003.

The Snapshot Viewer interface component comprises a compound file binary format mechanism and is used by Access to store screen shots of data reports into usable files. Those files can be printed from the program and/or transferred to Excel, PowerPoint and other Office applications.

The vulnerability lies in Active X, which is a component object model (COM) control used for data object transfer and processing within the Windows enterprise environment. It allows for object creation and editing in any just about computer programming language.

Microsoft has offered a workaround for this vulnerability via its enhanced security configuration mode, which is available by default in Internet Explorer programs sitting on Windows Server 2003 and Windows Server 2008 operating systems. The enhanced security configuration mode sets the security level for the Internet zone to "High." It helps manage risks from Web sites that users have not pegged as "trusted," as indicated in the Internet Explorer trusted sites zone settings file.

"Although these workarounds will not correct the underlying vulnerability, they help block known attack vectors," Sisk wrote. He added that "while the attack appears to be targeted, and not widespread," Microsoft will continue to monitor the issue and work with its Security Response Alliance partners to protect clients and customers.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • Microsoft Warns SameSite Cookie Changes Could Break Some Apps

    IT pros could face Web application issues as early as next month with the implementation of a coming SameSite Web change, which will affect how cookies are used across sites.

  • Populating a SharePoint Document Library by E-Mail, Part 1

    While Microsoft doesn't allow you to build a SharePoint Online document library using e-mail, there is a roundabout way of getting the job done using the tools that are included with Office 365. Brien shows you how.

  • Microsoft Previews New App Reporting and Consent Tools in Azure AD

    Microsoft last week described a few Azure Active Directory improvements for organizations wanting to connect their applications to Microsoft's identity and access service.

  • Free Software Foundation Asks Microsoft To Release Windows 7 Code

    The Free Software Foundation this week announced that it has established a petition demanding that Microsoft release its proprietary Windows 7 code as free software.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.