Threat Level: green Handler on Duty: Russell Eubanks

SANS ISC: InfoSec Handlers Diary Blog - Internet Explorer XML Vulnerability InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Internet Explorer XML Vulnerability

Published: 2006-11-06
Last Updated: 2006-11-06 17:25:45 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
Microsoft released a knowledge base article about a newly reported vulnerability in XMLHTTP 4.0 ActiveX Control. This Active-X control is required to interact with specific web sites using XML queries. We are not aware of any widely used applications of this technology. While it is similar to Ajax in scope, it does not look like it is required to use Ajax.

In line with Microsofts advisory, we recommend setting the respective kill bit to disable execution of this ActiveX control:
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\
{88d969c5-f192-11d4-a65f-0040963251e5}]
"Compatibility Flags"=dword:00000400


(we had a mention of a possible PoC from the Month-of-Kernel-bugs project. but it looks like these are two distinct issues)

Keywords:
0 comment(s)
Diary Archives