Friday, January 28, 2011

Microsoft Security Advisory 2501696 and Fix it


Microsoft released Security Advisory 2501696 which relates to a publicly disclosed vulnerability in the MHTML protocol handler. The vulnerability affects all current versions of Windows except Server Core.  Because this is a Windows vulnerability, the version of IE is not relevant.  The vulnerability could allow an attacker to cause a victim to run malicious scripts when visiting various Web sites, resulting in information disclosure.

The recommendations in the Security Advisory are two-fold.  I added a third recommendation, which is to disable ActiveX with WinPatrol.

1.  Enable the MHTML protocol lockdown, which can be accomplished via the Microsoft Fix It in Microsoft KB Article 2501696. When a security update is released, undo the lockdown of MHTML.
2. Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones.  To raise the browsing security level in Internet Explorer, follow these steps:
  • Launch Internet Explorer and select the Tools menu and click Internet Options.
  • Under Internet Options, select the Security tab and then click the Internet icon.
  • Under Security level for this zone, move the slider to High.  (This sets the security level for all Web sites to High.
Note:  If no slider is visible, click Default Level and then move the slider to High.

Use WinPatrol to disable ActiveX

ActiveX can be disabled with WinPatrol.   By default only those controls used by Internet Explorer are displayed. WinPatrol allows you to disable ActiveX controls by setting the "Kill-bit" found in the Windows registry. Disabling a control will not delete any files from your system. You can Enable a killed control at any time in the future.

References:





Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

4 comments:

Cel said...

Hi Corrine: Hope you are fine. Right now we are waiting for second wave of the snow storms to arrive.

I am using XP Pro3 Sp3 I was able to disable MS Active X items using WinPatrol in the Admin account but there are still ones enabled in the Limited User Account. They won't disable in LUA. Any ideas. Thanks

Corrine said...

Hi, Cel. From what I've seen, it appears you got a bit more snow in your area than we received her (west of you).

I don't have an answer for you but will check point Bill to your question, although he may still be involved in snow cleanup. :)

Cel said...

Hi Corrine. Storms over and bright and sunny here.

Thank you for the reply

I found a work around that I should have thought of earlier. Duh

I changed my LUA to Admin and made the changes disabling all the Active X then back to LUA. It worked.

Corrine said...

Excellent, thanks for letting me know, Cel.

(Sunny here too today and tomorrow and then snow predicted for the next several days. Maybe the snow won't make it all the way east to you.)