Intrusion Prevention

MS.XMLHTTP.ActiveX.Control.Remote.Code.Execution

Description

This indicates an attack attempt to exploit a remote Code Execution vulnerability in Microsoft XML Core Service XMLHTTP ActiveX Control.
The vulnerability can be exploited through misuse of the "setRequestHeader" property. It may allow remote attackers to execute arbitrary code in the context of the application using the affected ActiveX control. Failed exploit attempts will likely cause the program to crash, resulting in a Denial of Service condition.

Affected Products

Microsoft XML Core Services 6.0
Microsoft XML Core Services 4.0
HP Storage Management Appliance 2.1
+ HP Storage Management Appliance III
+ HP Storage Management Appliance II
+ HP Storage Management Appliance I
Avaya S8100 Media Servers R9
Avaya S8100 Media Servers R8
Avaya S8100 Media Servers R7
Avaya S8100 Media Servers R6
Avaya S8100 Media Servers R12
Avaya S8100 Media Servers R11
Avaya S8100 Media Servers R10
Avaya S8100 Media Servers 0
+ Microsoft Windows 2000 Server
+ Microsoft Windows NT Server 4.0 SP6a
Avaya Messaging Application Server

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.
Denial of Service: Remote attackers can crash vulnerable systems.

Recommended Actions

Apply the latest update from the vendor.
Microsoft XML Core Services 6.0
Microsoft Vulnerabilities in Microsoft XML Core Services 6.0 Could Allow Remote Code Execution (927977)
http://www.microsoft.com/downloads/details.aspx?familyid=9AE7F4E9-8228-4098-AF71-49C35684C17E&displaylang=en
Microsoft XML Core Services 4.0
Microsoft Vulnerabilities in Microsoft XML Core Services 4.0 Could Allow Remote Code Execution (927978)
http://www.microsoft.com/downloads/details.aspx?familyid=24B7D141-6CDF-4FC4-A91B-6F18FE6921D4&displaylang=en

CVE References

CVE-2006-5745