As the advisory mentions, this exploit only works for IE5.5+, and I quote: "Any application that hosts the WebBrowser control (5.5+) is affected since..." Many people seem to have missed that and emailed us about the fact that "it doesn't work here!" while using IE5, so to make it perfectly clear; The bug only exists in IE5.5 and later versions, even if you set your Internet Zone to disable the download of ActiveX. Regardless of all this, we were notified of a possible workaround and thought that this is important to share; Since the injected <object> runs in the "My Computer" Zone changing the Internet Zone's settings didn't affect it, but changing the correct zone's settings will prevent this exploit from running.. Here is the registry information: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] Change "1004" (DWORD) to 0x3. Many thanks to Axel Pettinger and Garland Hopkins for this workaround. Regards, L. Dagon, GreyMagic Software, Israel. -----Original Message----- From: Stefan Osterlitz [mailto:stefan@osterlitz.de] Sent: Friday, March 01, 2002 13:02 To: GreyMagic Software Cc: BUGTRAQ@SECURITYFOCUS. COM Subject: Re: IE execution of arbitrary commands without Active Scripting orActiveX (GM#001-IE) > Solution: > ========= > There is no configuration-tweaking workaround for this bug, it will work as > long as the browser parses HTML. The only possible solution must come in the > form of a patch from Microsoft. IMHO this is wrong. you can disable the download of signed / unsigned activex controls. my ie version 5.00.2614.3500 w/patches is not vulnerable with that setting. > Tested on: > ========== > IE5.5sp2 Win98, all patches, Active scripting and ActiveX disabled. > IE5.5sp2 NT4 sp6a, all patches, Active scripting and ActiveX disabled. > IE6sp1 Win2000 sp2, all patches, Active scripting and ActiveX disabled. > IE6sp1 WinXP, all patches, Active scripting and ActiveX disabled.
