Re: IE execution of arbitrary commands without Active Scripting or ActiveX (GM#001-IE)

From: Stefan Osterlitz (stefanat_private)
Date: Fri Mar 01 2002 - 03:01:49 PST

  • Next message: Maher Odeh: "Re: ... Tiny Personal Firewall ..." 

    > Solution:
> =========

> There is no configuration-tweaking workaround for this bug, it will work
as
> long as the browser parses HTML. The only possible solution must come in
the
> form of a patch from Microsoft.

IMHO this is wrong. you can disable the download of signed / unsigned
activex controls.
my ie version 5.00.2614.3500 w/patches is not vulnerable with that setting.



> Tested on:
> ==========

> IE5.5sp2 Win98, all patches, Active scripting and ActiveX disabled.
> IE5.5sp2 NT4 sp6a, all patches, Active scripting and ActiveX disabled.
> IE6sp1 Win2000 sp2, all patches, Active scripting and ActiveX disabled.
> IE6sp1 WinXP, all patches, Active scripting and ActiveX disabled.

    This archive was generated by hypermail 2b30 : Fri Mar 01 2002 - 19:17:38 PST