Feeds

Rogue ActiveX controls menace users

A new class at Vulnerability High

5 things you didn’t know about cloud backup

Flaws in ActiveX controls are being increasingly used to run security exploits.

Arbitrary file overwrite and deletion flaws, typically exploited through ActiveX controls, are well on the way to becoming a new class of security flaw, according to net security firm Symantec.

"These vulnerabilities exist particularly because of a registered ActiveX control failing to restrict which domains may load the control for execution. An attack exploiting this vulnerability can lead to arbitrary code execution by a remote attacker," a blog posting by Symantec researcher Parveen Vashishtha warns.

Since May, Symantec has logged 40 vulnerabilities of this type in applications from vendors including VMware, Microsoft Visual Studio, NCTSoft, and HP Photo Digital Imaging. The flaws are easy enough to exploit. The approach also carries additional benefits for hackers.

For example, a malicious payload of a batch file may come enclosed within a signed ActiveX control, which means that user intervention to approve the actions of a malicious payload may not be required. Typical exploitation scenarios include tricking a user into visiting a maliciously-controlled website.

Fortunately, by default, Internet Explorer blocks ActiveX controls. But consumers should be wary about allowing anything except trusted ActiveX controls. Third-party security products can also defend again the threat, which is explained in greater depth in a posting by Symantec here. ®

5 things you didn’t know about cloud backup

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?