A vulnerability has been reported in various Microsoft products, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error in the Masked Edit ActiveX control (Msmask32.ocx) and can be exploited to cause a stack-based buffer overflow by tricking a user into e.g. visiting a malicious website, which initializes the object with an overly long "Mask" parameter.

Successful exploitation allows execution of arbitrary code.

The vulnerability is reported in Msmask32.ocx version 6.0.81.69 included in Microsoft Visual Studio 6.0. Other versions may also be affected.

NOTE: The vulnerability is currently being actively exploited.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported as a 0-day.

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS08-070 (KB932349):
http://www.microsoft.com/technet/security/Bulletin/MS08-070.mspx

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers