Mike Cheng
03/07/04, 03:05
Here are the fixes to patch the 2 vulnerability referenced here http://isc.sans.org/diary.php?date=2004-06-27 and here http://www.microsoft.com/security/incident/download_ject.mspx, and stop cross-zone scripting for IE without affecting daily web browsing
abilities.
1. Fix the adodb.stream vulnerability so you won't download files through a web page. Modify or add the following registry key to set a kill bit on this CLSID.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX
Compatibility\{00000566-0000-0010-8000-00AA006D2EA4}] "Compatibility
Flags"=dword:00000400
2. Change the security setting for the hidden "Local Computer Zone" in IE. To show the zone you need to modify the following registry.
[HKEY CURRENT USER\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings\Zones\0]
"Flags"= dword:00000001
Then open up IE and go to "Tools" -> "Internet Options" -> "Security" tab -> click on the "My Computer" zone and set the "Custom" security to high.
Doing this will affect the files that you open on local machine, so if you are developing a app locally remember to switch back to medium or low security.
Here's a tip if you are a developer, add a new zone in the registry for unrestricted setting and add 127.0.0.1 and your machine name the the site.
You can add a zone by exporting one of the keys under
HKEY CURRENT USER\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings\Zones\
and modify it to your liking and add it back in the registry.
abilities.
1. Fix the adodb.stream vulnerability so you won't download files through a web page. Modify or add the following registry key to set a kill bit on this CLSID.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX
Compatibility\{00000566-0000-0010-8000-00AA006D2EA4}] "Compatibility
Flags"=dword:00000400
2. Change the security setting for the hidden "Local Computer Zone" in IE. To show the zone you need to modify the following registry.
[HKEY CURRENT USER\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings\Zones\0]
"Flags"= dword:00000001
Then open up IE and go to "Tools" -> "Internet Options" -> "Security" tab -> click on the "My Computer" zone and set the "Custom" security to high.
Doing this will affect the files that you open on local machine, so if you are developing a app locally remember to switch back to medium or low security.
Here's a tip if you are a developer, add a new zone in the registry for unrestricted setting and add 127.0.0.1 and your machine name the the site.
You can add a zone by exporting one of the keys under
HKEY CURRENT USER\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings\Zones\
and modify it to your liking and add it back in the registry.