vendor:
Active Setup Control
by:
Juan Carlos Garcia Cuartango
7.5
CVSS
HIGH
Active Setup Control vulnerability
20
CWE
Product Name: Active Setup Control
Affected Version From: Internet Explorer 4.0
Affected Version To: Outlook Express 4.72.3612
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows 95/Windows NT 4, Windows 98, Windows 2000
1999
Microsoft Internet Explorer 4.0 for Windows 95/Windows NT 4,Internet Explorer 4.1 for Windows 95/Windows 98/Windows NT 4,Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Internet Explorer 4.0.1 for Windows 98/Windows NT 4.0,Outlook 2000 0/98 0,Outlook Express 4.27.3110/4.72.2106/4.72.3120/4.72.3612 ActiveX CAB File Execution Vulnerability
Microsoft's Active Setup Control (asctrls.ocx) shipped with Internet Explorer 4 and above has a vulnerability in it as discovered by Juan Carlos Garcia Cuartango <cuartango@teleline.es>, which was posted on BUGTRAQ (ID 775) in the month of November, 1999. This vulnerability allows for almost any kind of break-in into client systems.
Mitigation:
Microsoft has released patches for its control which may be procured from its website.