Security flap over support ActiveX controls bug

Help!

By John Leyden • Get more from this author

Posted in Enterprise Security, 27th February 2007 16:32 GMT

Free whitepaper – Vulnerability management buyer's checklist

Flaws in an ActiveX component incorporated in many technical support support packages create a risk of hacking attacks, security watchers warn.

SupportSoft's ActiveX controls are subject to multiple buffer overflow vulnerabilities, which create a means for hackers to inject malware onto vulnerable systems. The controls are used by internet service providers (ISPs) and PC manufacturers for remote assistance and other technical support functions, creating a large pool of potentially vulnerable users. Exploitation would involve tricking users into visiting maliciously constructed websites featuring ActiveX controls that take advantage of SupportSoft's vulnerabilities.

Organisations using the technology include IBM, Telefonica, BT, Symantec and Bank of America, among others. Symantec users should apply an update as explained here. SupportSoft has also published an advisory. However since most third-party software packages don't exactly advertise their use of SupportSoft components, most ordinary users won't be aware whether they are exposed to the problem or not.

Because of this potential dilemma security clearing house US CERT advises users to disable SupportSoft ActiveX controls in Internet Explorer as a precautionary workaround (as explained here). More simply users might want to disable ActiveX controls in the Internet Zone but this might render some websites unusable. ®

Free whitepaper – The starter PKI program