ActiveX flaw could affect up to 70 apps

The vulnerability lies in an ActiveX component used by Microsoft's Internet Explorer

A vulnerability within a software component used in more than 70 products could allow an attacker to remotely run malware on a targeted system.

The vulnerability lies in 'NCTAudioFile2.dll', an ActiveX component used by Microsoft's Internet Explorer.

An attacker could use a specially crafted web page to exploit the vulnerability and take control of a system, warned Danish security firm Secunia. 

The component is made by Online Media Technologies Ltd, a UK-based firm that produces .Net and ActiveX components for developers. The company said that its clients include AT&T, Dell and Intel. 

Secunia estimates that the vulnerable component is used by more than 70 products from at least 28 different software developers.

The security firm has warned all vendors distributing the component, but has not yet heard back from Online Media Technologies.

While the vulnerability lies in a third-party component, Secunia said that it is partially up to the developers who use NACTAudioFile2 in their products to help protect users.

"Just because you did not develop the original library file or component does not mean that you can eschew support for it, and leave it up to the original vendor to create a patch," said Secunia technical writer Ina Ragragio.

Secunia rates the vulnerability as 'highly critical', its second highest severity rating.

Ragragio said that Secunia is not aware of any publicly available exploit for the vulnerability, but that "actually crafting one is pretty straightforward".

The company recommends that users either disable ActiveX or use a different web browser than Internet Explorer.

Online Media Technologies did not immediately respond to a request for comment.

• Mozilla Firefox 2.0.0.1 download
• Opera 9.1 download