July 14, 2008, 9:40 AM — An easy-to-use toolkit used to hack computers has now been updated to take advantage of an unpatched security vulnerability in Microsoft's software, which could mean attacks will intensify, according to vendor Symantec.
The Neosploit toolkit is one of several on the Internet that can be used by less-technical hackers to compromise machines. Symantec said it has detected on its network of Internet sensors that Neosploit can take advantage of a vulnerability revealed early last week in Microsoft's Access database program.
"Further analysis of these honeypot compromises has revealed that the exploit has been added to a variant of the Neosploit exploit kit, it will very likely reach a larger number of victims," according to an entry on the company's ThreatCon advisory board.
Microsoft hasn't patched the bug yet, and the company just issued its patches for the month on July 8. The vulnerability is within the Snapshot Viewer ActiveX control, which launches a viewer for Microsoft Access reports that doesn't require running the Access software itself.
The vulnerability poses a special danger since the ActiveX control is digitally signed by Microsoft, which means that people who have Internet Explorer configured to trust ActiveX controls with that designation would run it automatically if encountered on a Web page.
Some of the Web pages that have already been hacked with automated SQL injection attacks earlier this year are also hosting the Microsoft Acess attack, according to Symantec's Sean Hittel.
"As is the case with most of these ActiveX attacks, they are being served by traditional Web sites that have themselves fallen victim to automated SQL injection attacks," Hittel wrote on a Symantec forum. "In the past, we have seen government, commercial, and hobby sites fall victim to these SQL injection attacks and subsequently begin serving exploits to each of their visitors."
The problematic viewer accompanies all supported versions of Microsoft Office Access except Microsoft Access 2007,
Microsoft has offered suggestions in a security advisory to prevent attacks until a patch is available.
