[Full-disclosure] Extremely critical Windows XMLHTTP ActiveX 0-day reported

[Juha-Matti Laurio]

To share information released via MS advisory during the weekend:

More information is available at
Microsoft Security Advisory #927892
"Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution"
http://www.microsoft.com/technet/security/advisory/927892.mspx
some workarounds listed

and

"ActiveX - reason of the newest Windows 0-day, again"
http://blogs.securiteam.com/?p=717

This code execution vulnerability is target of active exploitation already.
Reportedly the problem is that setRequestHeader() can’t handle HTTP requests correctly.

The vulnerable component is XMLHTTP 4.0 ActiveX Control, part of Microsoft XML Core Services 4.0.
As a ActiveX issue it triggers with MSIE (probably IE6 and IE7 are both affected).

- Juha-Matti