Additional details on the System Monitor ActiveX buffer overflow
6 Nov. 2000
Summary
The USSR Team has found a vulnerability in the Microsoft System Monitor ActiveX control (class id: C4D2D8E0-D1DD-11CE-940F-008029004347, sysmon.ocx). The Value field name "LogFileName" could be used by a malicious web server operator to potentially run code on a visiting user's machine.
The vulnerability can only be exploited if ActiveX controls are enabled in Internet Explorer, Outlook or Outlook Express.
Credit:
The information has been provided by USSR Labs.
Vulnerable systems:
Microsoft Windows 2000 Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
If a user accesses an HTML page with the above code, IE, Outlook and Outlook Express will crash. The following error message will appear in the event log:
"Application popup: iexplore.exe - Application Error : The instruction at "0x64a8e132" referenced memory at "0x006100dd". The memory could not be "written".
