[Full-disclosure] Extremely critical Windows XMLHTTP ActiveX 0-day reported

[Juha-Matti Laurio <juha-matti.laurio@xxxxxxxx>]

To share information released via MS advisory during the weekend:

More information is available at
Microsoft Security Advisory #927892
"Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution"
http://www.microsoft.com/technet/security/advisory/927892.mspx
some workarounds listed

and

"ActiveX - reason of the newest Windows 0-day, again"
http://blogs.securiteam.com/?p=717

This code execution vulnerability is target of active exploitation already.
Reportedly the problem is that setRequestHeader() can?t handle HTTP requests 
correctly.

The vulnerable component is XMLHTTP 4.0 ActiveX Control, part of Microsoft XML 
Core Services 4.0.
As a ActiveX issue it triggers with MSIE (probably IE6 and IE7 are both 
affected).

- Juha-Matti


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/