Dear Steven M. Christey, --Thursday, March 5, 2009, 9:41:00 PM, you wrote to bugtraq@xxxxxxxxxxxxxxxxx: SMC> Note that a Google search for phrases like "Initialize and script ActiveX SMC> controls not marked as safe for scripting" with "Enable" will return an SMC> unsettling number of documents from vendors that tell their customers to SMC> change their browsers to these unsafe settings, in order to get their own SMC> products to work. SMC> Given that such a setting could affect ALL controls - not just the ones SMC> from the original vendor who needed it - I think this needs to be factored SMC> into any software developer's threat model. SMC> It would be very informative for someone somewhere to do a study to see SMC> how many browsers are running with such unsafe settings. I wouldn't be SMC> surprised if it's 10% or more. Steve, ActiveX is cross-application software component. These components are written for very different tasks, sometimes specially to manage hardware, sensitive data, e.g. to extend scripting facilities of server sofware, etc. Limiting ActiveX to safe operations only is inadequate loss of functionality. It's like blaming some non-suid administration utility to be insecure if used as CGI (if it's not developed to be used in such way) and requiring _any_ utility to be safe if copied to cgi-bin folder. If somebody allows controls not marked safe for scripting in his browser - it's like enabling ssh access with pre-defined account. If vendor recommends to do so - you should make a choice between vendor and security. -- Skype: Vladimir.Dubrovin ~/ZARAZA http://securityvulns.com/
