Security Vulnerability in DirectX Files Viewer ActiveX Control

Microsoft has released a patch for a security vulnerability that exists in the DirectX Files Viewer control (Xweb.ocx).

For additional information, click the following article number to view the article in the Microsoft Knowledge Base: For additional information about the latest service pack for Microsoft Windows 2000, click the following article number to view the article in the Microsoft Knowledge Base:

The DirectX Files Viewer control is an older ActiveX control that has been retired. There is a buffer-overrun vulnerability in this control. This vulnerability might cause Internet Explorer to stop working, or might permit an attacker to run arbitrary code and to gain control of your computer. This control (Xweb.ocx) has the following class identifier (CLSID): The patch sets the "kill" bit for this control. For additional information about setting the "kill" bit for an ActiveX control, click the following article number to view the article in the Microsoft Knowledge Base: The DirectX File Viewer control is not installed by default with Internet Explorer; it is typically used only by developers or support professionals. This control has been retired and is no longer supported. However, to protect customers, the patch prevents this control from running or from being reintroduced on your computer. The patch prevents this by setting the "kill" bit for this component.