Access database hit by new ActiveX hole

Cyber-criminals are exploiting a bug in software used by Microsoft's Access in a new online attack, Microsoft has warned.

The flaw lies in the Snapshot Viewer ActiveX control, which ships with "all supported versions of Microsoft Office Access except Microsoft Access 2007," Microsoft said in a security advisory.

Microsoft released few details of how the bug is actually being exploited, but said that it was investigating an ongoing computer attack that takes advantage of the problem. "The attack appears to be targeted, and not widespread," wrote Microsoft's Bill Sisk in a blog posting.

Attackers are trying to lure victims to a specially crafted web page that tries to run the attack code within Internet Explorer. The bug gives attackers a way to run their malicious software on the victim's machine.

Microsoft's Security Advisory offers a number of possible work-arounds for the problem, but the company has not said when it plans to fix the underlying bug.

"We encourage affected customers to implement the manual work-arounds included in the Advisory, which Microsoft has tested," Sisk said. "Although these work-arounds will not correct the underlying vulnerability, they help block known attack vectors."

Snapshot Viewer lets PC users view a Microsoft Access report without having to run the Access software itself. It can be downloaded as stand-alone software.

Because the vulnerable ActiveX control is digitally signed by Microsoft, some users could be attacked even if they haven't installed the Snapshot Viewer control. Victims who have configured Internet Explorer to trust Microsoft software could be forced to silently download the buggy viewer and then be attacked via the web, said Matthew Richard, director of Verisign's iDefense Rapid Response Team.

Microsoft has made a concerted effort to lock down its core Windows operating system over the past five years and, as a result, hackers have increasingly turned to third-party software and ActiveX components like Snapshot Viewer when looking for bugs.

In April, criminals began using software that included attack code for seven ActiveX bugs, including flaws in controls made by Microsoft, Citrix Systems, Hewlett-Packard, Sony and D-Link.

This latest issue is "another in the long line of ActiveX bugs," said Andrew Storms, director of security operations with nCircle, via instant message. "It's disheartening to see yet another ActiveX problem."