ActiveX Controls Still Vulnerable After Four Years

Activity spotted by an eWeek reporter on at least two "gray-hat" vulnerability research sites appears to indicate that an exploit for a weakness in one of Microsoft's Multimedia ActiveX controls discovered last June may still be feasible, even after four years of patches.

The fact that this set of controls, which was last used in Internet Explorer 5.0 and is still installed on many systems, could be so easily exploited to trigger heap overflows, has been a published fact since at least 2003.

Just last June, however, gray-hat firm Xsec found at least one other way to keep exploiting them. The US Department of Homeland Security was apparently notified of the exploit in late August, and released a bulletin last week. That bulletin stated the exploit had been witnessed running in IE 6.0 SP1, though the DHS rated its severity as "low."

The exploit Xsec discovered is frighteningly simple: Unchecked JavaScript code, reportedly running on a Chinese-language version of Windows Server 2003 prior to SP1, can be used to instantiate Microsoft's DirectAnimation library. By passing it a parameter for generating a spline -- a curved path -- using a value that's out-of-bounds for that function, a heap overflow condition is triggered. The original code, published by SecurityFocus, does not contain a payload for deployment after triggering the condition.

A recently published version of this exploit, on Xsec and one other site, essentially re-creates the exploit by enabling curious parties to compile a C-language routine that deploys it via the Windows Command Prompt.

SecurityFocus has catalogued the exploit as Bugtraq ID 19738, and states it knows of no patches released thus far that specifically address the issue. Meanwhile, Internet Security Systems classifies the exploit as "high risk," stating no known remedy existed as of its last update nearly three weeks ago.

This DAXCTLE exploit, for lack of a better name, is merely the latest in a series of recent security troubles for Microsoft that could be considered a "heap overflow" of a different variety.

Although more unpatched exploits from years past are being characterized as "zero-day exploits" for one reason or another, the problem for Microsoft has not been that malicious users are implementing exploits the same day vulnerabilities are discovered. The real issue is that they're successfully continuing to find exploits four years or more after the underlying problems are known.