-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

AusCERT Update AU-2007.0009 - [Win]
Exploit code publicly released for Microsoft ADODB.Connection ActiveX
Control vulnerability
27 March 2007

        AusCERT Update Summary
        ----------------------

Product:              Microsoft Data Access Components
Publisher:            US-CERT
Operating System:     Windows Server 2003
                      Windows XP
                      Windows 2000
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-5559
Member content until: Tuesday, April 24 2007

Ref:                  ESB-2007.0092

Original Bulletin:    http://www.us-cert.gov/current/index.html#ADODBActiveX

US-CERT has released a current activity report regarding publicly available 
exploit code for a recent vulnerability in the Microsoft ADODB.Connection 
ActiveX Control (MS07-009).

An attacker may exploit this vulnerability by enticing a user to visit a 
specially crafted webpage, resulting in the execution of code as the user 
running Internet Explorer. Similar vulnerabilities have been used to install 
malicious software for the purposes of identity theft. AusCERT recommends 
administrators patch or mitigate this vulnerability as soon as possible.

Please refer to the US-CERT website for more information.


AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRghpMyh9+71yA2DNAQLhBgP/dO+FCdufPpHCzVBzQfesI769f29va7d9
mM/n4fVCQUUIK7pdQjRs+MiQh3SOPQx+xvbHNFigTw5DObZcEVrT5Tq065S6V0IC
tfEGDa1VpTEcnIn7ovc9NoqitvUBTlRvy5hM7FMUZL8RGa5wuHV73e8PDLJcRN+9
wajUtkYK28Q=
=1ok1
-----END PGP SIGNATURE-----