Microsoft warns of vulnerability in Access

Microsoft has issued a security advisory specific to its database
program in Microsoft Office. The exploit permits "limited targeted
attacks leveraging a potential vulnerability in the ActiveX
control" for certain components of Microsoft Access.

According to Security Response Communications Manager Bill Sisk,
any attacker who successfully exploits this vulnerability "could
gain the same user rights as the logged-on user."

Sisk said, via an e-mail, that the vulnerability affects the
ActiveX control for the Snapshot Viewer in Microsoft Office Access
2000, Microsoft Office Access 2002 and Microsoft Office Access

The Snapshot Viewer interface component comprises a compound
file binary format mechanism and is used by Access to store screen
shots of data reports into usable files. Those files can be printed
from the program and/or transferred to Excel, PowerPoint and other
Office applications.

The vulnerability lies in Active X, which is a component object model (COM)
control used for data object transfer and processing within the
Windows enterprise environment. It allows for object creation and
editing in any just about computer programming language.

Microsoft has offered a workaround for this vulnerability via
its enhanced security configuration mode, which is
available by default in Internet Explorer programs sitting on
Windows Server 2003 and Windows Server 2008 operating systems. The
enhanced security configuration mode sets the security level for
the Internet zone to "High." It helps manage risks from Web sites
that users have not pegged as "trusted," as indicated in the
Internet Explorer trusted sites zone settings file.

"Although these workarounds will not correct the underlying
vulnerability, they help block known attack vectors," Sisk wrote.
He added that "while the attack appears to be targeted, and not
widespread," Microsoft will continue to monitor the issue and work
with its Security Response Alliance partners to protect clients and


  • business meeting (Monkey Business Images/

    Civic tech volunteers help states with legacy systems

    As COVID-19 exposed vulnerabilities in state and local government IT systems, the newly formed U.S. Digital Response stepped in to help. Its successes offer insight into existing barriers and the future of the civic tech movement.

  • data analytics (

    More visible data helps drive DOD decision-making

    CDOs in the Defense Department are opening up their data to take advantage of artificial intelligence and machine learning tools that help surface insights and improve decision-making.

Stay Connected