bugtraq - Workaround for stopping MS2003-030 exploitation via HTML?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <08D18BEFE0F59E4EB2BB78107B5A527101AB6E44@blaze.bcsc.gov.bc.ca>
Date: Fri, 25 Jul 2003 14:02:09 -0700
From: "Johnson, Jeff FOR:EX" <Jeff.S.Johnson@...s1.gov.bc.ca>
To: bugtraq@...urityfocus.com
Subject: Workaround for stopping MS2003-030 exploitation via HTML?

CERT recently issued an advisory about this vulnerability (CA-2003-18,
http://www.cert.org/advisories/CA-2003-18.html) that said that setting the
Internet Explorer 'Run ActiveX Controls' security setting to disable in
appropriate IE security zones would prevent exploitation of this in web
pages and HTML-format email. This sort of makes sense, since media player
can be used as an ActiveX control.

Can anyone confirm that this is really true, though?

Jeff Johnson
Technical Development Analyst, MoF IMG
Jeff.S.Johnson@...s1.gov.bc.ca
(250) 356-6968