Compaq Computer said ActiveX programs that ship with its popular desktop and notebook Presario lines contain a flaw which could allow hackers to over-write files on users' machines if they visit a specially-constructed Web page or read a booby-trapped HTML e-mail.

In an advisory issued late yesterday, Compaq said it includes the ActiveX controls on Presarios to perform customer support tasks. The company classified the threat as a denial of service vulnerability.

The system bugs were first publicized two years ago by Richard Smith, chief technology officer for the Privacy Foundation, in a message to the NTBugTraq mailing list.

Earlier this year, Smith sent the computer manufacturer a note saying that his new Compaq Presario 1700 series laptop had come shipped with about a dozen pre-installed ActiveX controls which were marked "safe for scripting."

"Many of these controls," he wrote were "hardly safe."

In fact, Smith argues that the Compaq Presario and operating systems, including Windows 98 and Windows Me, contain Active X methods for writing files to hard drives with controls that can easily be tampered with from HTML e-mail messages, Web pages, or rogue code.

By definition, an Active X control can be automatically downloaded and executed by a Web browser. Programmers can develop ActiveX controls in a variety of languages, including C, C++, Visual Basic and Java.

"They ship something like eleven ActiveX controls that can write to the hard drive and over-write files," Smith said in an interview with InternetNews.com. "So the term 'denial of service' is kind of a misnomer. It can destroy data or the operating system. So I think this is a bigger deal."

For its part, a Compaq spokesperson said the company issued a patch to about 2 million users through a Compaq services connection.

The spokesperson also added that all Presario computers contained ActiveX controls. And with so many users at risk, Compaq has started a security mailing list service to keep users up-to-date. So far, 260,000 people have signed up.

So while Compaq is certainly taking an active interest in the problem, perhaps most startling is Smith's contention that PC vendors continue to sell computers that can be tweaked by hackers.

"PC vendors don't seem to understand ActiveX security and have shipped software preinstalled on computers that create backdoors that open people's machines wide open to hackers," he said.

What's disturbing to Smith, and countless other users, is that ActiveX controls have full access to the Windows operating system. To control this risk, Microsoft developed a registration system so that browsers can identify and authenticate an ActiveX control before downloading it.

Compaq says it has no plans to ask vendors to stop shipping Presario computers.

*Brian McWilliams of InternetNewsRadio also contributed to this story.