A Sudden Rise in ActiveX Vulnerabilities Part 1


The year 2006 saw the rise of numerous security trends such as attacks against social networks, initiatives by researchers to sequentially disclose many flaws in Web browsers and operating system kernels, attacks being used for financial gain, and a dramatic increase in the number of vulnerabilities affecting Web applications. During the last few months of the year, I have noticed another trend that did not receive much attention. There has been a significant increase in the vulnerabilities that affect ActiveX controls. These vulnerabilities can facilitate an assortment of attacks that may simply cause the disclosure of sensitive information to an attacker or, in the worst-case scenario, allow them to execute code to gain unauthorized access to an affected computer.

During the last few years there has been an increase in the number of vulnerabilities affecting ActiveX controls shipped by various vendors. In the year 2001, DeepSight Alert Services reported a single vulnerability affecting an AcitveX control. This number reached 50 during 2006. Symantec Security Response Weblog: A Sudden Rise in ActiveX Vulnerabilities Part 1

Linked by shanmuga Tuesday, 16th January 2007 11:37PM