CVE-2008-0015 in microsoft windows 2003 server
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka "Microsoft Video ActiveX Control Vulnerability."
Affected software: microsoft windows 2003 server, microsoft windows xp
Scores
- CVSS: 8.8 (high)
- EPSS: 76.58% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-02-17
- Published: 2009-07-07
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Microsoft Video ActiveX Control (msvidctl.dll): install MS09-032 or set the kill bits
Patch or upgrade. Installs security update MS09-032 (KB973346), which sets the kill bits for the vulnerable Microsoft Video ActiveX control so Internet Explorer will no longer load it from a web page. If you cannot patch right away, setting the kill bit for CLSID {0955AC62-BF2E-4CBA-A2B9-A63F772D46CF} in the registry blocks the same attack.
Applies to: Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2 (exploitable through Internet Explorer). Windows Vista and Server 2008 also get the kill bits as defense in depth.
- List the hosts still running Windows XP SP2/SP3, Windows Server 2003 SP2, Windows 2000 SP4, Vista or Server 2008 from your asset inventory or vulnerability scan results.
- On each host, install security update MS09-032 (KB973346, cumulative ActiveX kill bits) through WSUS, SCCM/ConfigMgr or the Microsoft Update Catalog, and install MS09-037 (ATL fixes) as well. Restart if the installer asks you to.
- To check a host, run: reg query "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}" /v "Compatibility Flags". It must return 0x400.
- Workaround if you cannot patch yet: run as administrator: reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}" /v "Compatibility Flags" /t REG_DWORD /d 0x400 /f. On 64-bit Windows, run it for HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility too. Microsoft advisory 972890 lists the other msvidctl CLSIDs to block the same way. To push it to many machines, use a Group Policy registry preference.
- Restart Internet Explorer, or log the users off and on again, so the kill bit takes effect.
- These Windows versions are end of life. Plan to replace them, and until then keep them off the internet and stop them browsing the web.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.