AplusWebMaster
Topic Starter
FYI…
- http://isc.sans.org/diary.php?storyid=1807
Last Updated: 2006-10-27 18:50:51 UTC
"A recently discovered vulnerability in ADODB.connection has a proof of concept exploit. Microsoft has mentioned it in their blog*. (This may) be the 'drive by' threat vector of the next little while. This particular threat impact is remote code execution of choice. The code creates new ActiveXObject('ADODB.Connection.2.7') and then executes a number of times. The PoC is a Denial of Service, but it is just a question of time until a working version with shellcode is out (if not already).
> Mitigation: Disable ActiveX completely, or only allow it in trusted zones.
US-CERT has published a note here**. "The ADODB.Connection ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following CLSID: {00000514-0000-0010-8000-00AA006D2EA4} "
* http://blogs.technet.com/msrc/archive/2006…-published.aspx
October 27, 2006
"…We are fully aware of the recent Proof of Concept (POC) code posting regarding ADODB.Connection. We have initiated our Software Security Incident Response Process to investigate this issue. Once we have completed the investigation and understand if there is a threat to customers we will take the appropriate action to protect and provide guidance – as required. As always we are working with our MSRA partners to monitor and secure the ecosystem. I'll do my best to keep everyone up to date as the investigation progresses."
** http://www.kb.cert.org/vuls/id/589272
Date Last Updated: 10/27/2006
~ 
- http://isc.sans.org/diary.php?storyid=1807
Last Updated: 2006-10-27 18:50:51 UTC
"A recently discovered vulnerability in ADODB.connection has a proof of concept exploit. Microsoft has mentioned it in their blog*. (This may) be the 'drive by' threat vector of the next little while. This particular threat impact is remote code execution of choice. The code creates new ActiveXObject('ADODB.Connection.2.7') and then executes a number of times. The PoC is a Denial of Service, but it is just a question of time until a working version with shellcode is out (if not already).
> Mitigation: Disable ActiveX completely, or only allow it in trusted zones.
US-CERT has published a note here**. "The ADODB.Connection ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following CLSID: {00000514-0000-0010-8000-00AA006D2EA4} "
* http://blogs.technet.com/msrc/archive/2006…-published.aspx
October 27, 2006
"…We are fully aware of the recent Proof of Concept (POC) code posting regarding ADODB.Connection. We have initiated our Software Security Incident Response Process to investigate this issue. Once we have completed the investigation and understand if there is a threat to customers we will take the appropriate action to protect and provide guidance – as required. As always we are working with our MSRA partners to monitor and secure the ecosystem. I'll do my best to keep everyone up to date as the investigation progresses."
** http://www.kb.cert.org/vuls/id/589272
Date Last Updated: 10/27/2006
~