Microsoft released Security Advisory 2501696 which relates to a publicly disclosed vulnerability in the MHTML protocol handler. The vulnerability affects all current versions of Windows except Server Core. Because this is a Windows vulnerability, the version of IE is not relevant. The vulnerability could allow an attacker to cause a victim to run malicious scripts when visiting various Web sites, resulting in information disclosure.
The recommendations in the Security Advisory are two-fold. I added a third recommendation, which is to disable ActiveX with WinPatrol.
1. Enable the MHTML protocol lockdown, which can be accomplished via the Microsoft Fix It in Microsoft KB Article 2501696. When a security update is released, undo the lockdown of MHTML.
- To lock down MHTML, Enable: Microsoft Fix it 50602
- To undo the lockdown of MHTML, Disable: Microsoft Fix it 50603
- Launch Internet Explorer and select the Tools menu and click Internet Options.
- Under Internet Options, select the Security tab and then click the Internet icon.
- Under Security level for this zone, move the slider to High. (This sets the security level for all Web sites to High.
Use WinPatrol to disable ActiveX
ActiveX can be disabled with WinPatrol. By default only those controls used by Internet Explorer are displayed. WinPatrol allows you to disable ActiveX controls by setting the "Kill-bit" found in the Windows registry. Disabling a control will not delete any files from your system. You can Enable a killed control at any time in the future.
References:
- MSRC: Microsoft releases Security Advisory 2501696
- Security Research & Defense: More information about the MHTML Script Injection vulnerability
- Tech Net Advisory: Microsoft Security Advisory (2501696): Vulnerability in MHTML Could Allow Information Disclosure
- Knowledge Base Article: Microsoft Security Advisory: Vulnerability in MHTML could allow information disclosure
Hi Corrine: Hope you are fine. Right now we are waiting for second wave of the snow storms to arrive.
ReplyDeleteI am using XP Pro3 Sp3 I was able to disable MS Active X items using WinPatrol in the Admin account but there are still ones enabled in the Limited User Account. They won't disable in LUA. Any ideas. Thanks
Hi, Cel. From what I've seen, it appears you got a bit more snow in your area than we received her (west of you).
ReplyDeleteI don't have an answer for you but will check point Bill to your question, although he may still be involved in snow cleanup. :)
Hi Corrine. Storms over and bright and sunny here.
ReplyDeleteThank you for the reply
I found a work around that I should have thought of earlier. Duh
I changed my LUA to Admin and made the changes disabling all the Active X then back to LUA. It worked.
Excellent, thanks for letting me know, Cel.
ReplyDelete(Sunny here too today and tomorrow and then snow predicted for the next several days. Maybe the snow won't make it all the way east to you.)