Celah keamanan pada Microsoft Video ActiveX Control yang menyerang Internet Explorer
Microsoft mengeluarkan Security Advisory (972890), Vulnerability in Microsoft Video ActiveX Control Could Allow Remote Code Execution. Celah kemananan ini terdapat pada Windows ActiveX Control bernama Microsoft Streaming Video control yang merupakan bagian dari DirectShow. Jika pengguna membuka website yang telah disisipi kode jahat dengan menggunakan browser Internet Explorer, penyerang dapat menyusup pada komputer korban menggunakan level yang saat itu sedang digunakan korban. Jika saat itu korban login sebagai Administrator maka pihak penyerang bisa mengambil alih kontrol komputer dengan level Administrator. Windows XP dan Windows Server 20003 rentan terhadap bugs ini. Dikatakan oleh Symantec, dalam percobaannya mengatakan pengguna Windows XP dengan IE 6 dan IE 7 beresiko terkena serangan dan pengguna Windows XP dengan IE 8 tidak beresiko. Namun demikian tidak ada pernyataan resmi tentang hal tersebut dari Microsoft. Walau Windows 2003 memiliki resiko terkena serangan namun Windows 2003 server lebih sulit dieksploitasi karena secara default Internet Explorer pada Windows 2003 Server berjalan pada mode Enhanced Security Configuration.
Berikut sistem yang beresiko dan aman dari celah keamanan Video ActiveX Control:
Sistem yang beresiko:
* Windows XP Service Pack 2 and Windows XP Service Pack 3
* Windows XP Professional x64 Edition Service Pack 2
* Windows Server 2003 Service Pack 2
* Windows Server 2003 x64 Edition Service Pack 2
* Windows Server 2003 with SP2 for Itanium-based Systems
Sistem yang aman:
* Microsoft Windows 2000 Service Pack 4
* Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2
* Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2
* Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
* Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
* Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
Microsoft langsung bekerja memperbaiki bugs ini. Dan untuk saat ini (sampai patch tersedia nanti) Microsoft menyarankan pengguna yang beresiko untuk mematikan fungsi Microsoft Video ActiveX Control pada Interner Explorer dengan cara memasukan killbit (memasukan DWORD value: 400) pada CLSID di Windows Registry “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\” berikut ini:
{011B3619-FE63-4814-8A84-15A194CE9CE3}
{0149EEDF-D08F-4142-8D73-D23903D21E90}
{0369B4E5-45B6-11D3-B650-00C04F79498E}
{0369B4E6-45B6-11D3-B650-00C04F79498E}
{055CB2D7-2969-45CD-914B-76890722F112}
{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}
{15D6504A-5494-499C-886C-973C9E53B9F1}
{1BE49F30-0E1B-11D3-9D8E-00C04F72D980}
{1C15D484-911D-11D2-B632-00C04F79498E}
{1DF7D126-4050-47F0-A7CF-4C4CA9241333}
{2C63E4EB-4CEA-41B8-919C-E947EA19A77C}
{334125C0-77E5-11D3-B653-00C04F79498E}
{37B0353C-A4C8-11D2-B634-00C04F79498E}
{37B03543-A4C8-11D2-B634-00C04F79498E}
{37B03544-A4C8-11D2-B634-00C04F79498E}
{418008F3-CF67-4668-9628-10DC52BE1D08}
{4A5869CF-929D-4040-AE03-FCAFC5B9CD42}
{577FAA18-4518-445E-8F70-1473F8CF4BA4}
{59DC47A8-116C-11D3-9D8E-00C04F72D980}
{7F9CB14D-48E4-43B6-9346-1AEBC39C64D3}
{823535A0-0318-11D3-9D8E-00C04F72D980}
{8872FF1B-98FA-4D7A-8D93-C9F1055F85BB}
{8A674B4C-1F63-11D3-B64C-00C04F79498E}
{8A674B4D-1F63-11D3-B64C-00C04F79498E}
{9CD64701-BDF3-4D14-8E03-F12983D86664}
{9E77AAC4-35E5-42A1-BDC2-8F3FF399847C}
{A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980}
{A2E3074E-6C3D-11D3-B653-00C04F79498E}
{A2E30750-6C3D-11D3-B653-00C04F79498E}
{A8DCF3D5-0780-4EF4-8A83-2CFFAACB8ACE}
{AD8E510D-217F-409B-8076-29C5E73B98E8}
{B0EDF163-910A-11D2-B632-00C04F79498E}
{B64016F3-C9A2-4066-96F0-BD9563314726}
{BB530C63-D9DF-4B49-9439-63453962E598}
{C531D9FD-9685-4028-8B68-6E1232079F1E}
{C5702CCC-9B79-11D3-B654-00C04F79498E}
{C5702CCD-9B79-11D3-B654-00C04F79498E}
{C5702CCE-9B79-11D3-B654-00C04F79498E}
{C5702CCF-9B79-11D3-B654-00C04F79498E}
{C5702CD0-9B79-11D3-B654-00C04F79498E}
{C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7}
{CAAFDD83-CEFC-4E3D-BA03-175F17A24F91}
{D02AAC50-027E-11D3-9D8E-00C04F72D980}
{F9769A06-7ACA-4E39-9CFB-97BB35F0E77E}
{FA7C375B-66A7-4280-879D-FD459C84BB02}Pada CLSID di “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility” tersebut silahkan masing-masing diganti isinya menjadi 400 HEXADECIMAL (DWORD).
Jika dirasa terlalu banyak mengganti value tersebut download Msvidct_killbit.reg di http://download.cenary.com/windows/registry/Msvidct_killbit.reg atau silahkan buat file baru dengan ekstensi .reg dan masukan string berikut ini.
Jangan lupa membackup Registry sebelumnya, dan dengan resiko ditanggung sendiri:
Msvidct_killbit.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{011B3619-FE63-4814-8A84-15A194CE9CE3}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0149EEDF-D08F-4142-8D73-D23903D21E90}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0369B4E5-45B6-11D3-B650-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0369B4E6-45B6-11D3-B650-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{055CB2D7-2969-45CD-914B-76890722F112}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{15D6504A-5494-499C-886C-973C9E53B9F1}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1BE49F30-0E1B-11D3-9D8E-00C04F72D980}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1C15D484-911D-11D2-B632-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1DF7D126-4050-47F0-A7CF-4C4CA9241333}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2C63E4EB-4CEA-41B8-919C-E947EA19A77C}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{334125C0-77E5-11D3-B653-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{37B0353C-A4C8-11D2-B634-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{37B03543-A4C8-11D2-B634-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{37B03544-A4C8-11D2-B634-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{418008F3-CF67-4668-9628-10DC52BE1D08}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4A5869CF-929D-4040-AE03-FCAFC5B9CD42}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{577FAA18-4518-445E-8F70-1473F8CF4BA4}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{59DC47A8-116C-11D3-9D8E-00C04F72D980}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{7F9CB14D-48E4-43B6-9346-1AEBC39C64D3}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{823535A0-0318-11D3-9D8E-00C04F72D980}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8872FF1B-98FA-4D7A-8D93-C9F1055F85BB}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8A674B4C-1F63-11D3-B64C-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8A674B4D-1F63-11D3-B64C-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9CD64701-BDF3-4D14-8E03-F12983D86664}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9E77AAC4-35E5-42A1-BDC2-8F3FF399847C}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A2E3074E-6C3D-11D3-B653-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A2E30750-6C3D-11D3-B653-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A8DCF3D5-0780-4EF4-8A83-2CFFAACB8ACE}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{AD8E510D-217F-409B-8076-29C5E73B98E8}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B0EDF163-910A-11D2-B632-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B64016F3-C9A2-4066-96F0-BD9563314726}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BB530C63-D9DF-4B49-9439-63453962E598}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C531D9FD-9685-4028-8B68-6E1232079F1E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C5702CCC-9B79-11D3-B654-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C5702CCD-9B79-11D3-B654-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C5702CCE-9B79-11D3-B654-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C5702CCF-9B79-11D3-B654-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C5702CD0-9B79-11D3-B654-00C04F79498E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAAFDD83-CEFC-4E3D-BA03-175F17A24F91}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D02AAC50-027E-11D3-9D8E-00C04F72D980}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F9769A06-7ACA-4E39-9CFB-97BB35F0E77E}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FA7C375B-66A7-4280-879D-FD459C84BB02}]
"Compatibility Flags"=dword:00000400Updated: 15 Juli 2009, Microsoft telah mengeluarkan update/patch untuk mengatasi bugs ini.
Silahkan download update MS09-032 disini: http://go.microsoft.com/fwlink/?LinkId=157386
Referensi:
http://www.microsoft.com/technet/security/advisory/972890.mspx
Did you enjoy this post? Why not leave a comment below and continue the conversation, or subscribe to my feed and get articles like this delivered automatically to your feed reader.
Comments
[...] mengeluarkan Security Advisory 972890 terkait dengan bugs pada Microsoft Streaming Video control yang menyerang Internet Explorer, Microsoft juga mengeluarkan Security Advisory 973472. Celah ini terdapat pada pada Office Web [...]
[...] Microsoft mengeluarkan enam update hari Selasa kemarin (15 Juli 2009). Dari enam update tersebut tiga diantaranya dalam kategori critical dan tiga lainnya dalam kategori important. Salah satu update tersebut untuk memperbaiki celah keamanan pada Microsoft Video ActiveX Control yang menyerang Internet Explorer. [...]
[...] Exploit Microsoft Video ActiveX yang menyerang internet Explorer [...]