Secunia

A vulnerability has been reported in Microsoft Windows Messenger, which can be exploited by malicious people to gain knowledge of sensitive information.

The vulnerability is caused due to the Messenger.UIAutomation.1 ActiveX control being marked "safe-for-scripting". This allows changing state, obtain contact information and a user's login ID, log on remotely to a user's Messenger client as the user, as well as initiating audio and video chat sessions without user interaction.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Haifei Li, Fortinet.

Changelog
Further details available in Customer Area

Original Advisory
MS08-050 (KB955702):
http://www.microsoft.com/technet/security/Bulletin/MS08-050.mspx

Fortinet:
http://www.fortiguardcenter.com/advisory/FGA-2008-18.html

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area