Executive Summary

Summary
Title Update Rollup for ActiveX Kill Bits
Informations
Name KB960715 First vendor Publication 2009-02-10
Vendor Microsoft Last vendor Modification 2009-06-17
Severity (Vendor) N/A Revision 1.2

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Microsoft is releasing a new set of ActiveX kill bits with this advisory.

The update includes kill bits for previously published Microsoft security bulletins:

  • MS08-070, Vulnerabilities in Visual Basic 6.0 Runtime Extended Files (ActiveX Controls) Could Allow Remote Code Execution (932349)

The update also includes kill bits for the following third-party software:

  • Akamai Download Manager. This security update sets a kill bit for an ActiveX control developed by Akamai Technologies. Akamai Technologies has released a security update that addresses a vulnerability in the affected component. For more information and download locations, see the security release from Akamai Technologies. This kill bit is being set at the request of the owner of the ActiveX controls. The class identifiers (CLSIDs) for this ActiveX control are as listed in the Frequently Asked Questions section of this advisory.
  • Research in Motion (RIM) AxLoader. This security update sets a kill bit for an ActiveX control developed by Research In Motion (RIM). RIM has released a security update that addresses a vulnerability in the affected component. For more information and download locations, see the security release from Research In Motion. This kill bit is being set at the request of the owner of the ActiveX controls. The class identifiers (CLSIDs) for this ActiveX control are as listed in the Frequently Asked Questions section of this advisory.

For more information about installing this update, see Microsoft Knowledge Base Article 960715.

General Information

Overview

Purpose of Advisory: Notification of the availability of an update of ActiveX kill bits.

Advisory Status: Microsoft Knowledge Base Article and associated update were released.

Recommendation: Review the referenced Knowledge Base Article and apply the appropriate update.

ReferencesIdentification
Microsoft Knowledge Base Article960715

This advisory discusses the following software.

Related Software
Microsoft Windows 2000 Service Pack 4
Windows XP Service Pack 2 and Service Pack 3
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista and Windows Vista Service Pack 1
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1
Windows Server 2008 for 32-bit Systems
Windows Server 2008 for x64-based Systems
Windows Server 2008 for Itanium-based Systems

Frequently Asked Questions

Do users with a Windows Server 2008 Server Core installation need to install this update?
Users with a Windows Server 2008 Server Core installation do not need to install this update. For more information on the Server Core installation option, see Server Core. Note that the Server Core installation option does not apply to certain editions of Windows Server 2008; see Compare Server Core Installation Options.

Why does this advisory not have a security rating associated with it?
This update contains kill bits for third-party controls not owned by Microsoft. Microsoft does not provide a security rating for vulnerable third-party controls.

Does this update replace the Cumulative Security Update of ActiveX Kill Bits (950760)?
No, for the purpose of automatic updating, this update does not replace the Cumulative Security Update of ActiveX Kill Bits (950760) that is described in Microsoft Security Bulletin MS08-032. Automatic updating will still offer the MS08-032 update to customers regardless of whether or not they installed this update (960715). However, customers who install this update (960715) do not need to install the MS08-032 update to be protected with all the kill bits set in MS08-032.

Why is Microsoft releasing this Update Rollup for ActiveX Kill Bits with a security advisory when previous kill bit updates were released with a security bulletin?
Microsoft is releasing this Update Rollup for ActiveX Kill Bits with an advisory because the new kill bits either do not affect Microsoft software, or had been previously set in a Microsoft Security Bulletin.

Does this update contain kill bits that were previously released in an Update Rollup for ActiveX Kill Bits?
Yes, this update also includes kill bits that were previously set in Microsoft Security Advisory 956391.

Does this update contain kill bits that were previously released in an Internet Explorer security update?
No, this update does not include kill bits that were previously released in an Internet Explorer security update. We recommend that you install the latest Cumulative Security Update for Internet Explorer.

What is a kill bit?
A security feature in Microsoft Internet Explorer makes it possible to prevent an ActiveX control from ever being loaded by the Internet Explorer HTML-rendering engine. This is done by making a registry setting and is referred to as setting the kill bit. After the kill bit is set, the control can never be loaded, even when it is fully installed. Setting the kill bit makes sure that even if a vulnerable component is introduced or is re-introduced to a system, it remains inert and harmless.

For more information, see Microsoft Knowledge Base Article 240797: How to stop an ActiveX control from running in Internet Explorer.

What is a security update of ActiveX kill bits?
This security update only contains the class identifiers (CLSID) of certain ActiveX controls that are the basis of this security update.

Why does this update not contain any binary files?
This update only makes changes to the registry to disable the control from instantiating in Internet Explorer.

Should I install this update if I do not have the affected component installed or use the affected platform?
Yes. Installing this update will block the vulnerable control from running in Internet Explorer.

Do I need to reapply this update if I install an ActiveX control discussed in this security update at a later date?
No, reapplying this update is not required. The kill bit will block Internet Explorer from running the control even if the control is installed at a later date.

What does this update do?
This update sets the kill bit for a list of class identifiers (CLSIDs).

The following class identifier relates to a request by Akamai to set the kill bit for a class identifier that is vulnerable. Further details can be found in the security release issued by Akamai:

Class Identifier
{FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1}

The following class identifier relates to a request by Research In Motion (RIM) to set the kill bit for a class identifier that is vulnerable. Further details can be found in the security release issued by RIM:

Class Identifier
{4788DE08-3552-49EA-AC8C-233DA52523B9}

The following class identifiers relate to the CAPICOM control addressed in Microsoft Security Bulletin MS08-070, Vulnerabilities in Visual Basic 6.0 Runtime Extended Files (ActiveX Controls) Could Allow Remote Code Execution (932349):

Class Identifier
{1E216240-1B7D-11CF-9D53-00AA003C9CB6}
{3A2B370C-BA0A-11d1-B137-0000F8753F5D}
{B09DE715-87C1-11d1-8BE3-0000F8754DA1}
{cde57a43-8b86-11d0-b3c6-00a0c90aea82}
{6262d3a0-531b-11cf-91f6-c2863c385e30}
{0ECD9B64-23AA-11d0-B351-00A0C9055D8E}
{C932BA85-4374-101B-A56C-00AA003668DC}
{248dd896-bb45-11cf-9abc-0080c7e7b78d}

Suggested Actions

Review the Microsoft Knowledge Base Article that is associated with this advisory

Microsoft encourages customers to install this update. Customers who are interested in learning more about this update should review Microsoft Knowledge Base Article 960715.

Workarounds

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

  • Prevent COM objects from running in Internet Explorer

    You can disable attempts to instantiate a COM object in Internet Explorer by setting the kill bit for the control in the registry.

    Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

    For detailed steps that you can use to prevent a control from running in Internet Explorer, see Microsoft Knowledge Base Article 240797. Follow the steps in this article to create a Compatibility Flags value in the registry to prevent a COM object from being instantiated in Internet Explorer.

    Note The class identifiers and corresponding files where the ActiveX objects are contained are documented under "What does this update do?" in the FAQ section above. Replace {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} below with the class identifiers found in this section.

    To set the kill bit for a CLSID with a value of {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}, paste the following text in a text editor such as Notepad. Then, save the file by using the .reg file name extension.

    Windows Registry Editor Version 5.00
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{ XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX }]
    "Compatibility Flags"=dword:00000400

    You can apply this .reg file to individual systems by double-clicking it. You can also apply it across domains by using Group Policy. For more information about Group Policy, visit the following Microsoft Web sites:

    • Group Policy collection
    • What is Group Policy Object Editor?
    • Core Group Policy tools and settings

    Note You must restart Internet Explorer for your changes to take effect.

    Impact of Workaround: There is no impact as long as the object is not intended to be used in Internet Explorer.

Original Source

Url : http://www.microsoft.com/technet/security/advisory/960715.mspx

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1

Open Source Vulnerability Database (OSVDB)

Id Description
51833 BlackBerry Application Web Loader ActiveX (AxLoader) Overflow

Information Assurance Vulnerability Management (IAVM)

Date Description
2009-02-19 IAVM : 2009-A-0016 - Blackberry Application Web Loader Vulnerability
Severity : Category II - VMSKEY : V0018403

Snort® IPS/IDS

Date Description
2015-09-03 Microsoft Windows Visual Basic Charts ActiveX function call access
RuleID : 35423 - Revision : 3 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Studio Msmask32 ActiveX function call access
RuleID : 27758 - Revision : 4 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Studio Msmask32 ActiveX clsid access
RuleID : 27757 - Revision : 4 - Type : BROWSER-PLUGINS
2014-01-10 Akamai DownloadManager ActiveX function call unicode access
RuleID : 15318 - Revision : 4 - Type : WEB-ACTIVEX
2014-01-10 Akamai DownloadManager ActiveX function call access
RuleID : 15317 - Revision : 9 - Type : BROWSER-PLUGINS
2014-01-10 Akamai DownloadManager ActiveX clsid unicode access
RuleID : 15316 - Revision : 4 - Type : WEB-ACTIVEX
2014-01-10 Akamai DownloadManager ActiveX clsid access
RuleID : 15315 - Revision : 9 - Type : BROWSER-PLUGINS
2014-01-10 Research In Motion AxLoader ActiveX function call unicode access
RuleID : 15314 - Revision : 5 - Type : WEB-ACTIVEX
2014-01-10 Research In Motion AxLoader ActiveX function call access
RuleID : 15313 - Revision : 10 - Type : BROWSER-PLUGINS
2014-01-10 Research In Motion AxLoader ActiveX clsid unicode access
RuleID : 15312 - Revision : 5 - Type : WEB-ACTIVEX
2014-01-10 Research In Motion AxLoader ActiveX clsid access
RuleID : 15311 - Revision : 11 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Animation Control ActiveX function call unicode access
RuleID : 15310 - Revision : 4 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Animation Control ActiveX function call access
RuleID : 15309 - Revision : 9 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Animation Control ActiveX clsid unicode access
RuleID : 15308 - Revision : 4 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Animation Control ActiveX clsid access
RuleID : 15307 - Revision : 9 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Basic Winsock ActiveX function call unicode access
RuleID : 15121 - Revision : 7 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Basic Winsock ActiveX function call access
RuleID : 15120 - Revision : 7 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Basic Winsock ActiveX clsid unicode access
RuleID : 15119 - Revision : 7 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Basic Winsock ActiveX clsid access
RuleID : 15118 - Revision : 7 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Basic Hierarchical FlexGrid ActiveX function call unicode ac...
RuleID : 15103 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Windows Visual Basic Hierarchical FlexGrid ActiveX function call ac...
RuleID : 15102 - Revision : 11 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Basic Hierarchical FlexGrid ActiveX clsid unicode access
RuleID : 15101 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Windows Visual Basic Hierarchical FlexGrid ActiveX clsid access
RuleID : 15100 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Basic FlexGrid ActiveX function call unicode access
RuleID : 15099 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Windows Visual Basic FlexGrid ActiveX function call access
RuleID : 15098 - Revision : 13 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Basic FlexGrid ActiveX clsid unicode access
RuleID : 15097 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Windows Visual Basic FlexGrid ActiveX clsid access
RuleID : 15096 - Revision : 10 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Basic DataGrid ActiveX function call unicode access
RuleID : 15095 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Windows Visual Basic DataGrid ActiveX function call access
RuleID : 15094 - Revision : 11 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Basic DataGrid ActiveX clsid unicode access
RuleID : 15093 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Windows Visual Basic DataGrid ActiveX clsid access
RuleID : 15092 - Revision : 11 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Basic Charts ActiveX function call unicode access
RuleID : 15091 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Windows Visual Basic Charts ActiveX function call access
RuleID : 15090 - Revision : 13 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Basic Charts ActiveX clsid unicode access
RuleID : 15089 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Windows Visual Basic Charts ActiveX clsid access
RuleID : 15088 - Revision : 11 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Common Controls Animation Object ActiveX function call unicode access
RuleID : 15087 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Windows Common Controls Animation Object ActiveX function call access
RuleID : 15086 - Revision : 10 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Common Controls Animation Object ActiveX clsid unicode access
RuleID : 15085 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Windows Common Controls Animation Object ActiveX clsid access
RuleID : 15084 - Revision : 10 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Studio Msmask32 ActiveX function call unicode access
RuleID : 14024 - Revision : 9 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Visual Studio Msmask32 ActiveX function call access
RuleID : 14023 - Revision : 16 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Visual Studio Msmask32 ActiveX clsid unicode access
RuleID : 14022 - Revision : 9 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Visual Studio Msmask32 ActiveX clsid access
RuleID : 14021 - Revision : 19 - Type : BROWSER-PLUGINS

Nessus® Vulnerability Scanner

Date Description
2009-02-11 Name : The remote Windows host is missing a security update containing ActiveX kill ...
File : smb_kb_960715.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
Date Informations
2016-06-28 20:08:57
  • Multiple Updates
2015-09-03 21:24:10
  • Multiple Updates
2014-02-17 11:38:47
  • Multiple Updates
2014-01-19 21:29:42
  • Multiple Updates