Month Of ActiveX Bugs Reveals Critical Vulnerabilities

The latest Month of Bugs project is off to a fast start.

After a brief respite from Month of Bug activities, researchers are honing their skills by finding vulnerabilities in ActiveX controls used by software developers. With the MoAxB just getting under way on May 1, so far they've already found two critical flaws -- one is even being called "highly critical."

The Month of Bugs projects have taken on the likes of Windows, Mac, and MySpace. The technology being given a once-over this time, Microsoft's ActiveX controls, is used to make Web pages richer and more interactive.

Researchers posted details of a denial-of-service bug in Office OCX PowerPoint Viewer. It's an ActiveX control that enables software to communicate with Microsoft PowerPoint files. The French Security Incident Response Team (FrSIRT) called the bug critical.

"A vulnerability has been identified in Office OCX PowerPoint Viewer, which could be exploited by remote attackers to cause a denial of service or take complete control of an affected system," wrote a FrSIRT analyst. "This issue is caused by a buffer overflow error in "PowerPointViewer.ocx" when calling certain methods e.g. "HttpDownloadFile()" with overly long arguments, which could be exploited by remote attackers to execute arbitrary commands by tricking a user into visiting a specially crafted Web page."

The second reported bug, which was posted by a researcher known only as shinnai, is in an Excel viewer.

There are several holes in the Excel Viewer OCX that Secunia rates as "highly critical."

"The vulnerabilities are caused due to boundary errors within the Excel Viewer ActiveX control (ExcelViewer.ocx)," wrote Secunia analysts. "These can be exploited to cause stack-based buffer overflows via overly long arguments passed to certain methods (e.g. "HttpDownloadFile()" or "OpenWebFile()"). Successful exploitation may allow execution of arbitrary code when a user visits a malicious Web site."

The vulnerabilities, according to Secunia, are confirmed in version 3.2.0.5, but other versions also may be affected.