New MSDDS Vulnerability in Microsoft Office and Microsoft Visual Studio

 
Jul 30, 2005

by Judith Dinowitz

In the wake of the Zotob worm, and the Plug 'N Play vulnerability (see our article on that), a new vulnerability was announced on August 17th, along with exploit code.

This issue is due to a memory corruption error when instantiating the "Msdds.dll" (Microsoft Design Tools Diagram Surface) object as an ActiveX control. This flaw could be exploited by an attacker to take complete control of an affected system via a specially crafted Web page.

Only systems where the "Msdds.dll" library is installed are vulnerable. (This library is installed with Microsoft Office and Microsoft Visual Studio.)

While there is no patch from Microsoft, the Internet Storm Center has announced several measures you can take to protect yourself:

  1. The ISC released a number of scripts to set the "kill bit" for the affected ActiveX component. This will prevent use of the vulnerable ActiveX component by Internet Explorer. msdds.dll may still be used by local applications (and this is ok). But this may break activex applications accessed via the browser, if they make use of this vulnerable function. Click here to download ISC's Patch.
  2. You can make the same change using the registry editor. You'll find the details in their Diary.
  3. Remove the vulnerable DLL from your system. (This may break applications that use it.)
  4. Use 'DropMyRights' to Limit an impact of an exploit.
  5. Use an alternative browser, such as Firefox, which doesn't use Active X. (They note that Netscape 8, which uses the MSIE to render code, may be vulnerable. They have not confirmed this yet.)

You'll find more information about this exploit, and about how to recognize malicious web pages that exploit this vulnerability, in the following articles:

Current Internet Threat Level (Internet Security Systems, August 17, 2005)

FrSirt Advisory (French Security Incident Response Team Advisory, August 17, 2005)

Internet Storm Center Diary (ISC, August 18, 2005)

Add a Comment
(If you subscribe, any new posts to this thread will be sent to your email address.)
  
Privacy | FAQ | Site Map | About | Guidelines | Contact | Advertising | What is ColdFusion?
House of Fusion | ColdFusion Jobs | Blog of Fusion | AHP Hosting