ActiveX Parameter Validation Vulnerability

A security vulnerability exists in Microsoft® Windows 2000 which could allow enable a malicious user to potentially run code on another user’s machine.

Issue

An ActiveX control that ships as part of Windows 2000 contains an unchecked buffer. If the control was called from a web page or HTML mail using a specially-malformed parameter, it would be possible to cause code to execute on the machine via a buffer overrun. This could potentially enable a malicious user to take any desired action on the user's machine, limited only by the permissions of the user.

The vulnerability could only be exploited if ActiveX controls are enabled in IE, Outlook or Outlook Express.

Affected Products

• Microsoft Windows 2000

Download

Patch: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=25532

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: November 2, 2000

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<