New Year, old flaws in Windows and Internet Explorer

Robert Vamosi CNET

Published: 17 Jan 2005

• 
• 
• 
• 
• 

If you thought upgrading to Windows XP SP2 would end your Windows security nightmares, think again. Last Tuesday, Microsoft released three new security bulletins for 2005, including one critical patch for Windows XP SP2, last year's much-touted security upgrade of the Windows XP operating system. While Windows XP SP2 recompiled most of the basic system files to better protect you from malicious buffer overflows, the flaw in MS05-001 involves ActiveX, Microsoft's clever answer to Sun's Java technology. The two other vulnerabilities announced as part of the January monthly update release don't affect Windows XP SP2.

Security bulletin number one
Simply put, ActiveX is an omnibus term for interactive Microsoft technologies on the Web. On the plus side, ActiveX allows Microsoft Office applications to communicate across networks and over the Internet. On the downside, ActiveX allows flashy advertising on Web sites. It's the latter that's worrisome, as criminal hackers could use fancy ads on Web sites or referrals to maliciously coded Web sites to download malformed HTML Help ActiveX Controls onto your unprotected PC, and then gain control of your machine. Among the many changes within Microsoft Windows XP SP2 is an enhanced Internet Explorer 6.0 that now displays which ActiveX Controls you're downloading whenever you visit a Web site. Non-Windows XP SP2 users don't have access to the enhanced version of Internet Explorer 6.0 -- last year, Microsoft announced that it's no longer adding new features to non-Windows XP SP2 Internet Explorer browsers. But even if you have XP 2 IE and can spot a maliciously coded HMTL Help ActiveX Control, what can you realistically do to stop it from infecting your PC?

My favourite anti-pop-up program, PopUpCop, includes XGuard, a nifty feature that blocks ActiveX downloads onto your computer. I like the granularity within PopUpCop because I can allow ActiveX on certain sites and block it on all others.

You can also go into Internet Explorer's tools and change the ActiveX setting from Enable to Prompt. The downside of this change is that on every Web page you visit, you'll see a dialogue box asking if you want to allow ActiveX Controls before IE downloads them. If you say no to the wrong control, you may also lose some functionality on that Web page. As an alternative, Microsoft, in its detailed summary of the security bulletin, offers other workarounds, including running the HTML Help ActiveX Control within the local security zone within Internet Explorer (for a detailed explanation of what that means, see MS05-001).

Bulletins two and three
The other critical flaw patched by Microsoft last Tuesday also involves Internet Explorer -- all versions. Should you surf to a page containing a maliciously formed cursor or icon, you may find yourself controlled by a remote cracker. MS05-002 is rated critical, in part, because there are already working exploits out on the Internet. Once an exploit is available, it is often only a matter of time before someone finds a way to create a virus or a worm from it. Trend Micro has an independent security assessment of this vulnerability.

Finally, the third patched flaw concerns the Windows indexing service, which is by default turned off on Windows XP and Windows Server 2003. Because of that, Microsoft has given MS05-003 its second-highest rating of 'important'.

Firefox to the rescue?
Mozilla Firefox has been designed to run without ActiveX. But in all fairness, now that people are rushing to install Firefox, more and more flaws have been announced. Still, the flaws discovered in Firefox pale against those that exist in Internet Explorer. For one thing, given that there are exploits for at least one of these new vulnerabilities, we know that criminal hackers are interested in attacking IE. When there's a worm spreading exclusively via Firefox, I'll let you know.

Related articles

• 
• 
• 
•