Microsoft MSN "Hrtbeat.ocx" ActiveX control contains unspecified vulnerability

Overview

A vulnerability exists in the Microsoft MSN “Hrtbeat.ocx” ActiveX control.

Description

ActiveX is a technology that allows programmers to create reusable software components that can be incorporated into applications to extend their functionality. Microsoft Internet Explorer provides support for the ActiveX technology. There is a vulnerability in the Microsoft MSN “Hrtbeat.ocx” ActiveX control. This control provides support for online gaming when visiting MSN related sites. The following information is provided in MS04-038:

This update sets the kill bit for the Hrtbeat.ocx ActiveX control. This control implements support for online gaming in MSN related sites. Internet Explorer no longer supports this control. This control has been found to contain a security vulnerability. To help protect customers who have this control installed, this update prevents the control from running or from being reintroduced onto users’ systems by setting the kill bit for the control. For more information about kill bits, see Microsoft Knowledge Base Article 240797.
For information on preventing ActiveX controls from running in Internet Explorer, please refer to the Microsoft article “How to Stop an ActiveX Control from Running in Internet Explorer.”

---

Impact

The impact of this vulnerability is not known. In the case of a buffer overflow, a remote attacker could execute arbitrary code with the privileges of the user running Internet Explorer. The attacker may also be able to cause a denial of service.

---

Solution

Apply Patch
Apply the appropriate patch referenced in Microsoft Security Bulletin MS04-038.

---

Vendor Information

673134

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation __ Affected

Updated: October 19, 2004

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please refer to Microsoft Security Bulletin MS04-038.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23673134 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.nextgenss.com/advisories/heartbeat.txt&gt;
• <http://www.microsoft.com/technet/security/bulletin/MS04-038.mspx&gt;
• <http://support.microsoft.com/default.aspx?id=240797&gt;
• <http://msdn.microsoft.com/workshop/components/activex/controls.asp&gt;
• <http://www.microsoft.com/com/tech/ActiveX.asp&gt;
• <http://securitytracker.com/alerts/2004/Oct/1011678.html&gt;
• <http://secunia.com/advisories/12806/&gt;

Acknowledgements

This vulnerability was reported by Microsoft. Microsoft credits NGS Software Ltd. for discovering the vulnerability.

This document was written by Damon Morda and Art Manion.

Other Information

CVE IDs:	CVE-2004-0978
Severity Metric:	3.19 Date Public: