mailing list archives
RE: IE execution of arbitrary commands without Active Scripting or ActiveX (GM#001-IE) + Workaround.
From: "GreyMagic Software" <security () greymagic com>
Date: Sun, 3 Mar 2002 03:02:18 +0200
As the advisory mentions, this exploit only works for IE5.5+, and I quote:
"Any application that hosts the WebBrowser control (5.5+) is affected
Many people seem to have missed that and emailed us about the fact that "it
doesn't work here!" while using IE5, so to make it perfectly clear;
The bug only exists in IE5.5 and later versions, even if you set your
Internet Zone to disable the download of ActiveX.
Regardless of all this, we were notified of a possible workaround and
thought that this is important to share;
Since the injected <object> runs in the "My Computer" Zone changing the
Internet Zone's settings didn't affect it, but changing the correct zone's
settings will prevent this exploit from running..
Here is the registry information:
Change "1004" (DWORD) to 0x3.
Many thanks to Axel Pettinger and Garland Hopkins for this workaround.
GreyMagic Software, Israel.
From: Stefan Osterlitz [mailto:stefan () osterlitz de]
Sent: Friday, March 01, 2002 13:02
To: GreyMagic Software
Cc: BUGTRAQ () SECURITYFOCUS COM
Subject: Re: IE execution of arbitrary commands without Active Scripting
There is no configuration-tweaking workaround for this bug, it will work
long as the browser parses HTML. The only possible solution must come in
form of a patch from Microsoft.
IMHO this is wrong. you can disable the download of signed / unsigned
my ie version 5.00.2614.3500 w/patches is not vulnerable with that setting.
IE5.5sp2 Win98, all patches, Active scripting and ActiveX disabled.
IE5.5sp2 NT4 sp6a, all patches, Active scripting and ActiveX disabled.
IE6sp1 Win2000 sp2, all patches, Active scripting and ActiveX disabled.
IE6sp1 WinXP, all patches, Active scripting and ActiveX disabled.