Microsoft Windows Indexing Service ActiveX control code execution (Script_Indexing_Service_Corruption)

About this signature or vulnerability

Proventia Desktop, Proventia Network IPS, RealSecure Server Sensor, RealSecure Network, Proventia-G 1.1 and earlier, Proventia Network MFS, Proventia Network IDS, IBM Security Server Protection for Windows, Proventia Server IPS for Linux technology, Virtual Server Protection for Vmware:

This signature detects web-scripting code with an apparent attempt to exploit a vulnerability in the Microsoft Indexing Service's ActiveX control, possibly leading to execution of the atttacker's instructions on the victim's computer.


Default risk level

High risk vulnerability  High

Sensors that have this signature

Proventia Desktop: 2440, Proventia Network IPS: XPU 29.100, RealSecure Server Sensor: XPU 29.100, RealSecure Network: XPU 29.100, Proventia-G 1.1 and earlier: XPU 29.100, Proventia Network MFS: XPU 29.100, Proventia Network IDS: XPU 29.100, IBM Security Server Protection for Windows: 2.0.300.2440, IBM Security Server Protection for Windows: 1.0.914.2440, IBM Security Server Protection for Windows: 2.1.14.2440, Proventia Server IPS for Linux technology: 29.100, Virtual Server Protection for Vmware: 1.0

Systems affected

Microsoft Windows 2000: SP4, Microsoft Windows XP: SP2, Microsoft Windows Server 2003: SP2, Microsoft Windows Server 2003: SP2 Itanium, Microsoft Windows Server 2003: SP2 x64, Microsoft Windows XP: SP2 x64 Professional, Microsoft Windows XP: SP3

Type

Unauthorized Access Attempt

Vulnerability description

The Microsoft Windows Indexing Service ActiveX control could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption error. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability using an Indexing Service COM object to corrupt memory and execute arbitrary code on the system with the privileges of the victim.

How to remove this vulnerability

Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS09-057. See References.

References

Microsoft Security Bulletin MS09-057
Vulnerability in Indexing Service Could Allow Remote Code Execution (969059)
http://www.microsoft.com/technet/security/bulletin/ms09-057.mspx

IBM Internet Security Systems Protection Alert
Microsoft Windows Indexing Service ActiveX Control Remote Code Execution
http://www.iss.net/threats/349.html

ISS X-Force
Microsoft Windows Indexing Service ActiveX control code execution
http://www.iss.net/security_center/static/53540.php

CVE
CVE-2009-2507
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2507