The Channel logo


By | John Leyden 27th February 2007 16:32

Security flap over support ActiveX controls bug


Flaws in an ActiveX component incorporated in many technical support support packages create a risk of hacking attacks, security watchers warn.

SupportSoft's ActiveX controls are subject to multiple buffer overflow vulnerabilities, which create a means for hackers to inject malware onto vulnerable systems. The controls are used by internet service providers (ISPs) and PC manufacturers for remote assistance and other technical support functions, creating a large pool of potentially vulnerable users. Exploitation would involve tricking users into visiting maliciously constructed websites featuring ActiveX controls that take advantage of SupportSoft's vulnerabilities.

Organisations using the technology include IBM, Telefonica, BT, Symantec and Bank of America, among others. Symantec users should apply an update as explained here. SupportSoft has also published an advisory. However since most third-party software packages don't exactly advertise their use of SupportSoft components, most ordinary users won't be aware whether they are exposed to the problem or not.

Because of this potential dilemma security clearing house US CERT advises users to disable SupportSoft ActiveX controls in Internet Explorer as a precautionary workaround (as explained here). More simply users might want to disable ActiveX controls in the Internet Zone but this might render some websites unusable. ®

alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe