full-disclosure - Re: ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 26 Sep 2006 09:07:13 +1200
From: "Bojan Zdrnja" <bojan.zdrnja@...il.com>
To: "Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>
Cc: botnets@...testar.linuxbox.org, full-disclosure@...ts.grok.org.uk,
	bugtraq@...urityfocus.com, Gadi Evron <ge@...uxbox.org>
Subject: Re: ZERT patch [was: 0day for IE (Disabling
	Javascript no longer a fix)]

On 9/26/06, Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]
<sbradcpa@...bell.net> wrote:
> Jesper's Blog : More options on protecting against recent IE
> vulnerabilities on a domain:
> http://msinfluentials.com/blogs/jesper/archive/2006/09/22/More-options-on-protecting-against-the-VML-vulnerability-on-a-domain.aspx
>
> I like that option better.  Leaves me supported and honestly I've not
> seen anything that I'm running that's used VML or freaked since I've
> done that?

Btw, there seems to be a small issue with unregistering the vgx.dll.

When you unregister this DLL, among the other things it also removes
the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Version Vector

There are two values this key has:

"IE" = "6.0000"
"VML" = "1.0"

When you re-register vgx.dll, it only recreates the VML value, and
doesn't recreate the IE value.

I'm not sure where this is used, but it could be wise to save this key
before unregistering the DLL (it's easy to recreate it though).

Bojan

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/