Download [PORTABLE] Icacls.exe For Windows 2008
Download File --->>> https://shurll.com/2t0Or3
This article discusses complete file details, EXE file troubleshooting instructions for problems with icacls.exe, and a comprehensive set of free downloads for every file version that has been catalogued by our team.
If none of the previous three troubleshooting steps have resolved your issue, you can try a more aggressive approach (Note: Not recommended for amateur PC users) by downloading and replacing your appropriate icacls.exe file version. We maintain a comprehensive database of 100% malware-free icacls.exe files for every applicable version of Windows. Please follow the steps below to download and properly replace you file:
CAUTION : We strongly advise against downloading and copying icacls.exe to your appropriate Windows system directory. Microsoft typically does not release Windows EXE files for download because they are bundled together inside of a software installer. The installer's task is to ensure that all correct verifications have been made before installing and placing icacls.exe and all other EXE files for Windows. An incorrectly installed EXE file may create system instability and could cause your program or operating system to stop functioning altogether. Proceed with caution.
The xcacls.vbs script can handle the NTFS permissions, you can download it here - you'll need to modify it slightly to get it to work on Windows 7 \ Server 2008, but if you run cscript.exe xcacls.vbs /? on a Windows 7 or Server 2008 machine it will tell you how to modify it.
Microsoft also uses the NTFS ADS from Windows Vista/Windows Server 2008 (probably also for previous versions) to store zone information for files. When a file is downloaded from the Internet, it is assigned a zone information. According to articles from Microsoft, for IE, and this blog post, there is a ZoneID flag which may have the following values:
Alternatively, the plug-ins for Windows are also located on the Checkmk server under share/check_mk/agents/windows/plugins.They are also available from the agent download page in the Setup menu (as described in the Installation chapter) in the Plugins box:
ASP.NET is vulnerable to a denial of service vulnerability due to the way it manages request scheduling. An attacker could exploit this vulnerability by creating a specially crafted series of anonymous HTTP requests to an affected system and thereby cause the Web server running on this system to become non-responsive. (CVE-2009-1536)Microsoft has released a security update that addresses this vulnerability by changing the way ASP.NET manages request scheduling.ConsequenceSuccessful exploitation of these vulnerabilities allows an attacker to cause a denial of service by creating crafted HTTP requests.SolutionPatch:Following are links for downloading patches to fix the vulnerabilities:Windows Vista (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )Windows Vista (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )Windows Vista Service Pack 1 (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )Windows Vista Service Pack 1 (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )Windows Vista x64 Edition (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )Windows Vista x64 Edition (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )Windows Vista x64 Edition Service Pack 1 (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )Windows Vista x64 Edition Service Pack 1 (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )Windows Server 2008 for 32-bit Systems (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )Windows Server 2008 for 32-bit Systems (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )Windows Server 2008 for x64-based Systems (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-036.Workaround:- Switch to the IIS native thread pool. This can be done by the following two methods:Method 1: Specify the value for maxConcurrentRequestsPerCPU in the registry. This setting is global and affects all application pools.Method 2: Specify the value for maxConcurrentRequestsPerCPU for an application pool in the ASP.NET config section of an ASPNET.Config file. This setting allows configuration for individual application poolsImpact of workaround: Depending on the nature of applications running in this application pool, application performance may be affected.For detailed instructions on applying the workarounds, please refer to the Workaround section at Microsoft Security Bulletin MS09-036.Microsoft Telnet Remote Code Execution Vulnerability (MS09-042)SeverityMedium2Qualys ID42020Vendor ReferenceMS09-042CVE ReferenceCVE-2009-1930CVSS ScoresBase 10 / Temporal 7.8DescriptionTelnet is a bidirectional communications protocol that allows for command line remote access over the TCP protocol. Microsoft Telnet is vulnerable to a remote code execution issue because the telnet protocol does not correctly opt in to the NTML credential reflection protections. An attacker would have to host a specially crafted Telnet server and entice an unsuspecting user into visiting the malicious server to exploit this vulnerability. (CVE-2009-1930)Microsoft has released a security update that addresses the vulnerability by modifying the way that the Telnet service validates authentication replies in order to prevent the relay of credentials.Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):Aug 09 Security Updates for Standard 09 and XPe are Now Available (KB960859)ConsequenceSuccessful exploitation of these vulnerabilities allows an attacker to run arbitrary code as the logged-on user. An attacker with administrative rights can take complete control of the affected system and then install programs; view, change, or delete data; or create new accounts with full user rights.SolutionPatch:Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4Windows XP Service Pack 2 and Windows XP Service Pack 3Windows XP Professional x64 Edition Service Pack 2Windows Server 2003 Service Pack 2Windows Server 2003 x64 Edition Service Pack 2Windows Server 2003 with SP2 for Itanium-based SystemsWindows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2Refer to Microsoft Security Bulletin MS09-042 for further details.Microsoft Remote Desktop Connection Remote Code Execution Vulnerability (MS09-044)SeverityCritical4Qualys ID116552Vendor ReferenceMS09-044CVE ReferenceCVE-2009-1133, CVE-2009-1929CVSS ScoresBase 9.3 / Temporal 7.7DescriptionMicrosoft Remote Desktop Protocol (RDP) provides remote display and input capabilities over network connections for Microsoft Windows-based applications running on a server. The Remote Desktop Web Connection ActiveX control allows access to a computer, via the Internet, from another computer using Internet Explorer.- A remote code execution vulnerability exists in the way that Microsoft Remote Desktop Connection processes specific parameters returned by the RDP server. This issue results in a heap overflow on the client. An attacker could convince a user to connect to a malicious RDP server, or could perform a man-in-the-middle attack and subsequently exploit this vulnerability on the Remote Desktop Connection client. (CVE-2009-1133)- A remote code execution vulnerability exists because the Remote Desktop Web Connection ActiveX control methods do not perform sufficient parameter validation. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could potentially allow remote code execution if a user visited that page. (CVE-2009-1929)Microsoft has released a security update that addresses these vulnerabilities by changing the way the Remote Desktop Connection deals with unexpected parameters sent by the RDP server and by correctly validating parameters passed to the Remote Desktop Connection ActiveX control methods.Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):Aug 09 Security Updates for Standard 09 and XPe are Now Available (KB970927, 956744, 958470)ConsequenceSuccessful exploitation of these vulnerabilities allows an attacker to run arbitrary code as the logged-on user. An attacker with administrative rights can take complete control of the affected system and then install programs; view, change, or delete data; or create new accounts with full user rights.SolutionPatch:Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4 (RDP Version 5.0 )Microsoft Windows 2000 Service Pack 4 (RDP Version 5.0 )Microsoft Windows 2000 Service Pack 4 (RDP Version 5.1 )Microsoft Windows 2000 Service Pack 4 (RDP Version 5.2 )Windows XP Service Pack 2 (RDP Version 5.1 )Windows XP Service Pack 2 (RDP Version 5.2 )Windows XP Service Pack 2 (RDP Version 6.1 )Windows XP Service Pack 2 (RDP Version 6.0)Windows XP Service Pack 3 (RDP Version 6.1 )Windows XP Service Pack 3 (RDP Version 5.2 )Windows XP Professional x64 Edition Service Pack 2 (RDP Version 5.2)Windows XP Professional x64 Edition Service Pack 2 (RDP Version 6.1)Windows Server 2003 Service Pack 2 (RDP Version 5.2)Windows Server 2003 Service Pack 2 (RDP Version 6.0)Windows Server 2003 x64 Edition Service Pack 2 (RDP Version 5.2)For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-044.Workarounds:For CVE-2009-1133: 1) Restrict access to mstscax.dll.Impact of workaround #1: You will not be able to make outbound Remote Desktop connections.For CVE-2009-1929: 1) Prevent the Remote Desktop Connection ActiveX control from running in Internet Explorer by setting the kill bit for the control in the registry.Impact of workaround #1. Users will not be able to start remote desktop connections from within Web pages.2) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting in these zones.3) Configure Internet Explorer to prompt before running ActiveX controls or disable ActiveX controls in the Internet and Local intranet security zones.Impact of workarounds #2 and #3: On visting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.Microsoft Workstation Service Elevation of Privilege Vulnerability (MS09-041)SeverityCritical4Qualys ID90519Vendor ReferenceMS09-041CVE ReferenceCVE-2009-1544CVSS ScoresBase 9 / Temporal 7DescriptionThe Workstation service is a Windows component that supports the routing of remote file and network print resource requests.- An elevation of privilege vulnerability exists in the Workstation service due to the "Double Free" condition occurring in the service. A double free condition is a condition in which a program is caused to release or free allocated memory more than once. Releasing memory that has already been freed could lead to memory corruption. An attacker could exploit the vulnerability by creating a specially crafted RPC message and sending the message to an affected system. The message could then allow an authenticated client to write arbitrary data to memory in the Workstation service address space. (CVE-2009-1544)Microsoft has released a security update that addresses this vulnerability by correcting the manner in which the Workstation service allocates and frees memory.Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):Aug 09 Security Updates for Standard 09 and XPe are Now Available (KB971657)ConsequenceAn attacker who successfully exploited this vulnerability could run arbitrary code with elevated privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.SolutionPatch:Following are links for downloading patches to fix the vulnerabilities:Windows XP Service Pack 2 and Windows XP Service Pack 3Windows XP Professional x64 Edition Service Pack 2Windows Server 2003 Service Pack 2Windows Server 2003 x64 Edition Service Pack 2Windows Server 2003 with SP2 for Itanium-based SystemsWindows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2Refer to Microsoft Security Bulletin MS09-041 for further details.Workaround:- TCP ports 139 and 445 should be blocked at the firewall to protect systems behind the firewall from attempts to exploit this vulnerability. Impact of workaround: Blocking the ports can cause several windows services or applications using those ports to stop functioning.Microsoft Windows Message Queuing Elevation of Privilege Vulnerability (MS09-040)SeverityUrgent5Qualys ID90518Vendor ReferenceMS09-040CVE ReferenceCVE-2009-1922CVSS ScoresBase 6.9 / Temporal 5.4DescriptionMicrosoft Message Queuing technology enables applications that are running at different times to communicate across heterogeneous networks and across systems that may be temporarily offline.An elevation of privilege vulnerability exists in the Windows Message Queuing service (MSMQ) due to a specific flaw in the parsing of an IOCTL request to the Message Queuing service. The MSMQ service improperly checks input data before passing them to the buffer. An attacker could exploit this vulnerability by sending a specially crafted IOCTL request to the MSMQ service. (CVE-2009-1922)Microsoft has released a security update that addresses this vulnerability by modifying the way that the MSMQ service validates input data before passing the data to the allocated buffer.Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):Aug 09 Security Updates for Standard 09 and XPe are Now Available (KB971032)ConsequenceAn attacker who successfully exploits this vulnerability could execute arbitrary code and take complete control of an affected system under the LOCAL SYSTEM context. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.SolutionPatch:Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4Windows XP Service Pack 2Windows XP Professional x64 Edition Service Pack 2Windows Server 2003 Service Pack 2Windows Server 2003 x64 Edition Service Pack 2Windows Server 2003 with SP2 for Itanium-based SystemsWindows VistaWindows Vista x64 EditionRefer to Microsoft Security Bulletin MS09-040 for further details.Workaround:- Disable the Message Queuing Service. Steps on disabling the service via the Interactive Method are listed below:1) Click Start, and then click Control Panel. Alternatively, point to Settings, and then click Control Panel.2) Double-click Administrative Tools. Alternatively, click Switch to Classic View and then double-click Administrative Tools.3) Double-click Services.4) Double-click Message Queuing.5) In the Startup type list, click Disabled.6) Click Stop, and then click OK.- This service can also be disabled via Group Policy settings. - The MSMQ service can also be disabled by using the following command at the command prompt (available in Windows XP and in the Microsoft Windows 2000 Resource Kit):Sc stop MSMQ & sc config MSMQ start= disabledAdditional instructions on applying the workarounds can be found at Microsoft Security Bulletin MS09-040.Microsoft Windows Media File Processing Remote Code Execution Vulnerability (MS09-038)SeverityUrgent5Qualys ID90517Vendor ReferenceMS09-038CVE ReferenceCVE-2009-1545, CVE-2009-1546CVSS ScoresBase 9.3 / Temporal 6.9DescriptionAudio Video Interleave (AVI) is a special case of Resource Interchange File Format (RIFF). The .avi file format is a common container format for audio and video data on a computer.Windows Media file processing is prone to the following vulnerabilities:- The Windows component responsible for processing AVI files does not properly handle specially crafted AVI files with malformed headers. (CVE-2009-1545)- A remote code execution vulnerability exists in the way Microsoft Windows handles specially crafted AVI format files. (CVE-2009-1546)An attacker can exploit these vulnerabilities by enticing an unsuspecting user into opening a specially crafted AVI file or visit a malicious Web site that contains specially crafted streaming content.Microsoft has released a security update that addresses the vulnerabilities by correcting the manner in which AVI headers are processed and correcting the manner in which AVI data is validated.Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):Aug 09 Security Updates for Standard 09 and XPe are Now Available (KB971557)ConsequenceIf a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.SolutionPatch:Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4Windows XP Service Pack 2 and Windows XP Service Pack 3Windows XP Professional x64 Edition Service Pack 2Windows Server 2003 Service Pack 2Windows Server 2003 x64 Edition Service Pack 2Windows Server 2003 with SP2 for Itanium-based SystemsWindows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2Refer to Microsoft Security Bulletin MS09-038 for further details.Workarounds:1) Deny access to Avifil32.dll.On Windows 2000, Windows XP, and Windows Server 2003 systems, run the following command:For 32bit Windows: cacls %windir%\system32\avifil32.dll /E /P everyone:NFor 64bit Windows:cacls %windir%\syswow64\avifil32.dll /E /P everyoneOn Windows Vista and Windows Server 2008, run the following commands:For 32bit Windows: takeown.exe /f %windir%\system32\avifil32.dllicacls.exe %windir%\system32\avifil32.dll /save %TEMP%\AVIFIL32_ACL.TXTicacls.exe %windir%\system32\avifil32.dll /deny everyone:(F)For 64bit Windows:takeown /f %windir%\syswow64\avifil32.dllicacls %windir%\syswow64\avifil32.dll /save %TEMP%\AVIFIL32_ACL.TXTicacls %windir%\syswow64\avifil32.dll /deny everyone:(F)Impact of workaround #1: Applications that rely on the AVIFile API will fail to render AVI video content properly.2) Remove HKEY_CLASSES_ROOT\CLSID\(40C3D757-D6E4-4b49-BB41-0E5BBEA28817) to prevent Windows Explorer from previewing AVI files. This can be done via the Interactive Method or by using a Managed Deployment Script. Note:This workaround is only applicable for CVE-2009-1545.Impact of workaround #2: Windows Explorer will not provide a preview image for AVI files.For detailed instructions on applying the workarounds, please refer to Microsoft Security Bulletin MS09-038.Microsoft WINS Remote Code Execution Vulnerabilities (MS09-039)SeverityCritical4Qualys ID90516Vendor ReferenceMS09-039CVE ReferenceCVE-2009-1923, CVE-2009-1924CVSS ScoresBase 9.3 / Temporal 6.9DescriptionWindows Internet Name Service (WINS) is a protocol designed specifically to support NetBIOS over TCP/IP (NetBT).- A remote code execution vulnerability exists in the Windows Internet Name Service (WINS) due to a buffer overflow caused by incorrect calculation of buffer length when processing specially crafted WINS network packets. An attacker could exploit this vulnerability by sending a specially crafted WINS replication packet to an affected system running the WINS service. (CVE-2009-1923)- A remote code execution vulnerability exists in the default configuration of the Windows Internet Name Service (WINS) due to insufficient validation of data structures within specially crafted WINS network packets received from a trusted WINS replication partner. (CVE-2009-1924)Microsoft has released a security update that addresses these vulnerabilities by correcting the manner in which the WINS service calculates buffer length and introducing proper data validations on received packets on the WINS server.ConsequenceSuccessful exploitation of this vulnerability allows remote code execution. An attacker could gain complete control over the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts.SolutionPatch:Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Server Service Pack 4Windows Server 2003 Service Pack 2Windows Server 2003 x64 Edition Service Pack 2Windows Server 2003 with SP2 for Itanium-based SystemsRefer to Microsoft Security Bulletin MS09-039 for further details.Workaround:- Block TCP port 42 and UDP port 42 at the firewall to prevent systems that are behind that firewall from being attacked by attempts to exploit this vulnerability.Impact of workaround: Blocking the ports can cause several windows services or applications using those ports to stop functioning.Microsoft Active Template Library (ATL) Remote Code Execution Vulnerability (MS09-037)SeverityUrgent5Qualys ID90515Vendor ReferenceMS09-037CVE ReferenceCVE-2008-0015, CVE-2008-0020, CVE-2009-0901, CVE-2009-2493, CVE-2009-2494CVSS ScoresBase 10 / Temporal 8.7DescriptionMicrosoft Active Template Library is prone to the following vulnerabilities:- The function CComVariant::ReadFromStream used in the ATL header does not properly restrict untrusted data read from a stream. This issue could lead to reading data directly onto the stack instead of reading it into the area of memory allocated for an array. (CVE-2008-0015)- A remote code execution vulnerability is caused by an error in the Load method of the IPersistStreamInit interface. The Load method could allow calls to "memcopy" with untrusted data. (CVE-2008-0020)- A remote code execution vulnerability exists in the Microsoft Active Template Library (ATL) due to an issue in the ATL headers that could allow an attacker to force VariantClear to be called on a VARIANT that has not been correctly initialized. (CVE-2009-0901)- A vulnerability exists due to issues in the ATL headers that handle instantiation of an object from data streams. For components and controls built using ATL, unsafe usage of OleLoadFromStream could allow the instantiation of arbitrary objects which can bypass certain related security policies. (CVE-2009-2493)- A remote code execution vulnerability exists due to a bug in the ATL header that could allow reading a variant from a stream and leaving the variant type read with an invalid variant. When deleting the variant, it would be possible to free unintended areas in memory that could be controlled by an attacker, resulting in inconsistent memory contents and execution of malicious code. (CVE-2009-2494)Microsoft has released a security update that resolves these vulnerabilities in Microsoft Active Template Library (ATL) by modifying the ATL headers so that components and controls built using the headers can safely initialize from a data stream, and by providing updated versions of Windows components and controls built using corrected ATL headers.Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):Aug 09 Security Updates for Standard 09 and XPe are Now Available (KB973908, 973354, 973507, 973540, 973815, 973869)ConsequenceThe vulnerabilities could allow remote code execution if a user loaded a specially crafted component or control hosted on a malicious Web site. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.SolutionPatch:Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4 (Microsoft Outlook Express 5.5 Service Pack 2)Microsoft Windows 2000 Service Pack 4 (Microsoft Outlook Express 6 Service Pack 1)Microsoft Windows 2000 Service Pack 4 (Windows Media Player 9)Microsoft Windows 2000 Service Pack 4 (Windows ATL Component)Microsoft Windows 2000 Service Pack 4 (DHTML Editing Component ActiveX Control)Windows XP Service Pack 2 and Windows XP Service Pack 3 (Microsoft Outlook Express 6)Windows XP Service Pack 2 (Windows Media Player 9, Windows Media Player 10, and Windows Media Player 11)Windows XP Service Pack 3 (Windows Media Player 9)Windows XP Service Pack 3 (Windows Media Player 10, and Windows Media Player 11)Windows XP Service Pack 2 and Windows XP Service Pack 3 (Windows ATL Component)Windows XP Service Pack 2 and Windows XP Service Pack 3 (DHTML Editing Component ActiveX Control)Windows XP Service Pack 2 and Windows XP Service Pack 3 (Microsoft MSWebDVD ActiveX Control)Windows XP Professional x64 Edition Service Pack 2 (Microsoft Outlook Express 6)Windows XP Professional x64 Edition Service Pack 2 (Windows Media Player 10)For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-037.Workaround:- Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting.- Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.Impact of the Workaround:On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.Additional details on the workaround can be found at Microsoft Security Advisory (973882).Microsoft Office Web Components Remote Code Execution Vulnerability (MS09-043)SeverityUrgent5Qualys ID110101Vendor ReferenceKB973472, MS09-043CVE ReferenceCVE-2009-0562, CVE-2009-1136, CVE-2009-1534, CVE-2009-2496CVSS ScoresBase 9.3 / Temporal 8.1DescriptionMicrosoft Office Web Components are a collection of Component Object Model (COM) controls for publishing spreadsheets, charts, and databases to the Web, and for viewing the published components on the Web.- Office Web Components are prone to multiple remote code execution vulnerabilities that are caused when the ActiveX control is used in Internet Explorer. An attacker could exploit the vulnerability by constructing a specially crafted Web page. The control may corrupt the system state in such a way that an attacker could run arbitrary code. (CVE-2009-1136, CVE-2009-0562, CVE-2009-2496, CVE-2009-1534)Microsoft has released a security update that addresses these vulnerabilities by correctly handling memory allocation when the ActiveX control is used in Internet Explorer, correcting validation logic for Office Web Components ActiveX control methods, and performing additional parameter validation.Previously, Microsoft had released Microsoft Security Advisory (973472) for this vulnerability.Note: This vulnerability is applicable to versions of the software that are not listed in the official advisory.For details see: -043ConsequenceSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the user running the application. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.SolutionPatch:Following are links for downloading patches to fix the vulnerabilities:Microsoft Office XP Service Pack 3Microsoft Office 2003 Service Pack 3Microsoft Office 2000 Web Components Service Pack 3Microsoft Office XP Web Components Service Pack 3Microsoft Office 2003 Web Components Service Pack 3Microsoft Office 2003 Web Components Service Pack 1 for the 2007 Microsoft Office SystemMicrosoft Internet Security and Acceleration Server 2004 Standard Edition Service Pack 3Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition Service Pack 3Microsoft Internet Security and Acceleration Server 2006 Standard Edition Service Pack 1Microsoft Internet Security and Acceleration Server 2006 Enterprise Edition Service Pack 1Microsoft BizTalk Server 2002Microsoft Visual Studio .NET 2003 Service Pack 1Microsoft Office Small Business Accounting 2006Refer to Microsoft Security Bulletin MS09-043 for further details.Workarounds:1) Prevent Office Web Components Library from running in Internet Explorer by setting the kill bit for the control in the registry. Refer to Microsoft article KB240797 for information on setting the kill bits.Impact of workaround #1: Disabling the Office Web Component prevents Internet Explorer from instantiating the control. This configuration causes program compatibility issues when Office Web Components functionality is required.2) Unregister the Office Web Components Library.Impact of workaround #2: Applications requiring Office Web Components functionality will not function.3) Restrict Web sites to only your trusted Web sites.4) Set Internet and Local Intranet security zone settings to "High" to prompt before running ActiveX controls in these zones.Detailed instructions on applying the workarounds can be found at Microsoft Security Bulletin MS09-043.These new vulnerability checks are included in Qualysvulnerability signature1.23.51-4.Each Qualys account is automatically updated with the latestvulnerability signatures as they become available. To view thevulnerability signature version in your account, from theQualys Help menu, select the About tab. 2b1af7f3a8