iDefense COMRaider, ActiveX controls, and browser configuration




In disputing the COMRaider unsafe method vulnerability, iDefense Labs
said:

In short, if your machine allows this control to be loaded, then your
browser will load controls regardless of safety designations such as
"Safe for Scripting", "Safe for Initialization", and "IObjectSaftey".

Note that a Google search for phrases like "Initialize and script ActiveX
controls not marked as safe for scripting" with "Enable" will return an
unsettling number of documents from vendors that tell their customers to
change their browsers to these unsafe settings, in order to get their own
products to work.

Given that such a setting could affect ALL controls - not just the ones
from the original vendor who needed it - I think this needs to be factored
into any software developer's threat model.

It would be very informative for someone somewhere to do a study to see
how many browsers are running with such unsafe settings. I wouldn't be
surprised if it's 10% or more.

- Steve



Relevant Pages

  • Re: How does the FILE object in ASP.NET page locate the files saved in Mac machine ?
    ... Users can click the browse button to locate the files they want to upload ... How can they select these files to upload into the web server? ... such a way that most reasonably up to date browsers should cope with. ... web controls. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Using MSs IE MultiPage and TabStrip on public websites
    ... Given the statements made on that MSDN page, it sounds like these controls ... automatically offer a "downlevel" experience on older browsers. ... "Stephen Miller" wrote in message ... > IE 5.5+ and use a lot of XML to render content. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Footer?
    ... the text size controls on browsers as they are with volume ... think it would help greatly for there to be a consistent key ... control for this, widely taught. ...
    (alt.html)
  • Re: Is ASP.NET really as good as they claim? (No, this isnt a tro
    ... mrmac presents two browser related issues: client-side validation and HTML ... Microsoft in general has not made the most feature rich web controls. ... BrowserCapabilities for all of the modern browsers. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Can CSS do this?
    ... (not meaning to sound trollish; ... like controls and such ... This works in all browsers and can be nested inside of div's and other ... CSS is essentially weird and you will need to delve into ...
    (alt.html)