MS13-090: Cumulative Security Update of ActiveX Kill Bits (2900986)

high Nessus Plugin ID 70848

Language:

Synopsis

The remote Windows host is missing an update that disables selected ActiveX controls.

Description

The remote Windows host is missing a security update that sets kill bits to prevent Microsoft's InformationCardSigninHelper Class ActiveX control from instantiating in Internet Explorer. This control has a vulnerability that can be abused to execute arbitrary code remotely, if a user can be tricked into viewing a malicious web page using Internet Explorer. It is currently being exploited through limited, targeted attacks.

Solution

Microsoft has released a set of patches for Windows XP, 2003, Vista, 2008, 7, 2008 R2, 8, 2012, 8.1, 2012 R2, RT, and RT 8.1

Plugin Details

Severity: High

ID: 70848

File Name: smb_nt_ms13-090.nasl

Version: 1.17

Type: local

Agent: windows

Family: Windows : Microsoft Bulletins

Published: 11/13/2013

Updated: 10/6/2025

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.0

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2013-3918

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:microsoft:windows

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/12/2013

Vulnerability Publication Date: 11/8/2013

CISA Known Exploited Vulnerability Due Dates: 10/27/2025

Exploitable With

CANVAS (CANVAS)

Core Impact

Metasploit (MS13-090 CardSpaceClaimCollection ActiveX Integer Underflow)

Reference Information

CVE: CVE-2013-3918

BID: 63631

IAVA: 2013-A-0213

MSFT: MS13-090

MSKB: 2900986

Detections

Analytics