---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Microsoft Windows hxvz.dll ActiveX Control Memory Corruption SECUNIA ADVISORY ID: SA29714 VERIFY ADVISORY: http://secunia.com/advisories/29714/ CRITICAL: Highly critical IMPACT: System access WHERE: >From remote OPERATING SYSTEM: Microsoft Windows 2000 Advanced Server http://secunia.com/product/21/ Microsoft Windows 2000 Datacenter Server http://secunia.com/product/1177/ Microsoft Windows 2000 Professional http://secunia.com/product/1/ Microsoft Windows 2000 Server http://secunia.com/product/20/ Microsoft Windows Server 2003 Datacenter Edition http://secunia.com/product/1175/ Microsoft Windows Server 2003 Enterprise Edition http://secunia.com/product/1174/ Microsoft Windows Server 2003 Standard Edition http://secunia.com/product/1173/ Microsoft Windows Server 2003 Web Edition http://secunia.com/product/1176/ Microsoft Windows Server 2008 http://secunia.com/product/18255/ Microsoft Windows Vista http://secunia.com/product/13223/ Microsoft Windows XP Home Edition http://secunia.com/product/16/ Microsoft Windows XP Professional http://secunia.com/product/22/ DESCRIPTION: A vulnerability has been reported in Microsoft Windows, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to an error in the hxvz.dll ActiveX control and can be exploited to cause a memory corruption when a user e.g. is tricked into visiting a malicious website. Successful exploitation allows execution of arbitrary code. SOLUTION: Apply patches. Windows 2000 SP4 with Internet Explorer 5.01 SP4: http://www.microsoft.com/downloads/details.aspx?FamilyId=0395451F-B719-4F71-A7B4-403D0C7E8FCC Windows 2000 SP4 with Internet Explorer 6 SP1: http://www.microsoft.com/downloads/details.aspx?FamilyId=BA6D3AEB-E35A-47CC-BACE-7BD9D58A9D3F Windows XP SP2: http://www.microsoft.com/downloads/details.aspx?FamilyId=9DBF002F-FE53-4CC7-A430-35F45C520D10 Windows XP Professional x64 Edition (optionally with SP2): http://www.microsoft.com/downloads/details.aspx?FamilyId=01400970-DF68-4DAF-AA39-2FC4F969974C Windows Server 2003 SP1/SP2: http://www.microsoft.com/downloads/details.aspx?FamilyId=AD384FEA-53BE-4BE3-8ACB-1CD23A7F5405 Windows Server 2003 x64 Edition (optionally with SP2): http://www.microsoft.com/downloads/details.aspx?FamilyId=FFC5C893-CB24-4875-B0A7-6D5C7AA4D642 Windows Server 2003 with SP1/SP2 for Itanium-based systems: http://www.microsoft.com/downloads/details.aspx?FamilyId=94CF78D3-B6C3-41BC-993E-3AF3BE0D70F1 Windows Vista (optionally with SP1): http://www.microsoft.com/downloads/details.aspx?FamilyId=D7F14001-7F42-4CA0-9193-CDF061179B59 Windows Vista x64 Edition (optionally with SP1): http://www.microsoft.com/downloads/details.aspx?FamilyId=D33462B6-7391-482D-BABE-FB4CD0BEAA21 Windows Server 2008 for 32-bit Systems: http://www.microsoft.com/downloads/details.aspx?FamilyId=95691924-2813-4A86-9E11-99D853F8E606 Windows Server 2008 for x64-based Systems: http://www.microsoft.com/downloads/details.aspx?FamilyId=920AE29B-19D0-4089-AC79-F2DA824A2256 Windows Server 2008 for Itanium-based Systems: http://www.microsoft.com/downloads/details.aspx?FamilyId=66DF79AC-8364-4922-9688-EBC7EC76D89F PROVIDED AND/OR DISCOVERED BY: The vendor credits an anonymous researcher, reported via iDefense Labs. ORIGINAL ADVISORY: MS08-023 (948881) http://www.microsoft.com/technet/security/Bulletin/MS08-023.mspx ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------