CERT-In Vulnerability Note
CIVN-2010-0274
Microsoft WMI Administrative Tools WBEMSingleView.ocx ActiveX control vulnerability
Original Issue Date:December 27, 2010
Severity Rating: HIGH
Systems Affected
- Microsoft WMI Administrative Tools version 1.1 and prior
Overview
A vulnerability has been reported in Microsoft WMI Administrative Tools, which could allow remote attackers to execute arbitrary code on the targeted system.
Description
This vulnerability is caused due to a memory trust error in the "WBEMSingleView.ocx" ActiveX control. Memory trust error condition is caused when the parameter supplied via the "AddContextRef()" method as a pointer to "WBEMSingleView.ocx" ActiveX control. Remote attackers could exploit this vulnerability by enticing naive users to visit a specially crafted webpage. Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code on the targeted system.
Workaround
- Exercise caution while visiting websites links received in emails
- Disable ActiveX, if not in use.
- Disable the WMI Object Viewer ActiveX control in Internet Explorer
The vulnerable ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following CLSID:
{2745E5F5-D234-11D0-847A-00C04FD7BB08}
Microsoft Support Document 240797
http://support.microsoft.com/kb/240797 - Do not click on the links in email received unexpectedly from trusted sources or received from unknown/untrusted sources
- Read e-mails in plain text, if possible
- Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
- Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.
References
Microsoft
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=6430f853-1120-48db-8cc5-f2abdc3ed314
http://support.microsoft.com/kb/240797
WooYun
http://www.wooyun.org/bugs/wooyun-2010-01006
Secunia
http://secunia.com/advisories/42693
VUPEN
http://www.vupen.com/english/advisories/2010/3301
US-CERT
http://www.kb.cert.org/vuls/id/725596
CERT
http://www.cert.org/tech_tips/securing_browser/
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|