An easy-to-use toolkit used to hack computers has now been updated to take advantage of an unpatched security vulnerability in Microsoft's software, which could mean attacks will intensify, according to vendor Symantec.
The Neosploit toolkit is one of several on the Internet that can be used by less-technical hackers to compromise machines. Symantec said it has detected on its network of Internet sensors that Neosploit can take advantage of a vulnerability revealed early last week in Microsoft's Access database program.
"Further analysis of these honeypot compromises has revealed that the exploit has been added to a variant of the Neosploit exploit kit, it will very likely reach a larger number of victims," according to an entry on the company's ThreatCon advisory board.
Microsoft hasn't patched the bug yet, and the company just issued its patches for the month on July 8. The vulnerability is within the Snapshot Viewer ActiveX control, which launches a viewer for Microsoft Access reports that doesn't require running the Access software itself.
The vulnerability poses a special danger since the ActiveX control is digitally signed by Microsoft, which means that people who have Internet Explorer configured to trust ActiveX controls with that designation would run it automatically if encountered on a Web page.
Some of the Web pages that have already been hacked with automated SQL injection attacks earlier this year are also hosting the Microsoft Acess attack, according to Symantec's Sean Hittel.
"As is the case with most of these ActiveX attacks, they are being served by traditional Web sites that have themselves fallen victim to automated SQL injection attacks," Hittel wrote on a Symantec forum. "In the past, we have seen government, commercial, and hobby sites fall victim to these SQL injection attacks and subsequently begin serving exploits to each of their visitors."
The problematic viewer accompanies all supported versions of Microsoft Office Access except Microsoft Access 2007,
Microsoft has offered suggestions in a security advisory to prevent attacks until a patch is available.
- Sponsored Resource:How does your network security compare to those of your peers? Visit the CDW Security Center to find out.
- Sponsored Resource:Learn more about ultra light notebooks from Asus and the best warranty in the industry.
- Sponsored Resource:Thinking about a new Laptop? Lenovo has models to meet everyone's needs.
- Sponsored Resource:Get the truth about remanufactured ink. Learn more from HP.
- Sponsored Resource:Six smart ways to grow small business IT
News For Your Business
- Mafiaboy Grows Up; a Hacker Seeks Redemption
- Google in Curious Alliance With Click-fraud Detection Firm
- PCI App Security: Who's Guarding the Data Bank?
- Romanian Pleads Guilty to Phishing-related Charges
- Antivirus Superhero Comes to the Rescue
Community Comments