Saturday, 28 October 2006

Vulnerability Discovered in IE 6 ADODB.Connection ActiveX Control

Microsoft's Security Response Center has admitted that there is a flaw affecting its key ActiveX Data Objects database control, which is enrolled in COM under the handle ADODB.Connection. The vulnerability was apparently discovered by an independent researcher, and was brought to light by US-CERT and SecurityFocus.

The vulnerability is, not very complex, Since calls placed to the ADO library are asynchronous, the calling program need not pause while awaiting a response. The exploit, whose JavaScript element is only six instructions long, crafts a series of erroneous instructions within a long loop clause, with a method at the end that invokes ADO's SQL parser. It cannot possibly parse these instructions, but again, the calling program need not wait for an answer before proceeding to the next call, the company said.

It is possible that criminal hackers could use this new threat, considered by Microsoft to be a low risk, for so-called 'drive-by' downloads. This vulnerability has been assigned a National Vulnerability Database number of CVE-2006-5559.