ShareThis
Search result
Microsoft departed from their typical Tuesday notification to warn about a major security hole on Monday the 6th.
If you are using Internet Explorer on XP or windows server 2003, you are vulnerable. If you are using Vista, you are OK. There are active attacks trying to take advantage of this hole.
There are no patches, but disabling part of the affected video software closes the hole.
Here is the Microsoft Knowledgebase article that shows how to do that: http://support.microsoft.com/kb/972890
If you don't consider yourself highly experienced with Windows, use the Fix it for me link. As a matter of fact, even if you consider yourself highly experienced, you should use the automated fix. If you are the brave kind and want to do it yourself, go ahead:
Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:
| • |
Prevent Microsoft Video ActiveX Control from running in Internet Explorer Note See Microsoft Knowledge Base Article 972890 for information on how to implement this workaround automatically. You can disable attempts to instantiate a COM object in Internet Explorer by setting the kill bit for the control in the registry. Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk. For detailed steps that you can use to prevent a control from running in Internet Explorer, see Microsoft Knowledge Base Article 240797. Follow the steps in this article to create a Compatibility Flags value in the registry to prevent a COM object from being instantiated in Internet Explorer. The following Class Identifiers relate to Microsoft Video ActiveX Control:
Note The Class Identifiers and corresponding files where the ActiveX objects are contained are documented in the table above. Replace {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} below with the Class Identifier found in this table. To set the kill bit for a CLSID with a value of {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}, paste the following text in a text editor such as Notepad. Then, save the file by using the .reg file name extension. Windows Registry Editor Version 5.00 You can apply this .reg file to individual systems by double-clicking it. You can also apply it across domains by using Group Policy. For more information about Group Policy, visit the following Microsoft Web sites:
Note You must restart Internet Explorer for your changes to take effect. Impact of Workaround: There is no impact as long as the object is not intended to be used in Internet Explorer. |
