Intrusion PreventionMS.Works.WkImgSrv.DLL.ActiveX.Control.Access
Description
This indicates an attempt to exploit a remote code-execution vulnerability in Microsoft Works 7.
The vulnerability lies in the WkImgSrv.dll ActiveX control. It allows an attacker to execute arbitrary code with the privileges of the current user.
Affected Products
Microsoft Works 7
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Denial of Service: Remote attackers can crash vulnerable systems.
Recommended Actions
Set the kill bit on the CLSID "00E1DB59-6EFD-4CE7-8C0A-2DA3BCAAD9C6" by following the steps at: http://support.microsoft.com/kb/240797
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
Version Updates
| Date | Version | Detail |
|---|---|---|
| 2020-08-24 | 15.910 | Sig Added |
| 2020-08-13 | 15.905 | Modified |
| 2020-08-12 | 15.904 | Sig Added |
| 2020-08-04 | 15.899 | Modified |
| 2020-07-20 | 15.889 | Sig Added |
| ID | 15572 |
| Created | Apr 25, 2008 |
| Updated | Nov 15, 2021 |
| Risk |
|
| CVE ID | CVE-2008-1898 |
| Exploit Prediction Score | 96.71% |
| Default Action | drop |
| Active | |
| Affected OS | Windows |
| Affected App | Other |