Activate ActiveX Filtering in IE9

ActiveX Filtering is a new feature available in IE9 and it is disable by default.

It allows a whitelist style protection scheme. When enabled NO ActiveX Controls are allowed to run, then when you go to a site that requires ActiveX Controls, if you trust the site you can add them to the whitelist. Only websites on the list will be able to run ActiveX Controls.

To enable ActiveX Filtering, go to Tools Menu>Safety and then select the ActiveX Filtering Option.

Enable ActiveX Filtering

0day Exploit for WMI Administrative Tools

Microsoft WMI Administrative Tools is prone to a remote code-execution vulnerability that affects the WMI Object Viewer ('WBEMSingleView.ocx') ActiveX control.

The vulnerabilities are caused due to the "AddContextRef()" and "ReleaseContext()" methods in the WMI Object Viewer Control (WBEM.SingleViewCtrl.1) using a value passed in the "lCtxHandle" parameter as an object pointer.

An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage. Successful exploits will allow the attacker to execute arbitrary code within the context of the application (typically Internet Explorer) that uses the ActiveX control.

The vulnerabilities are confirmed in version 1.1 (WBEMSingleView.ocx 1.50.1131.0).

Workaround:
Set the kill-bit for the affected ActiveX control.


PoC Exploit is available at:

• Original credit goes to "牛奶坦克" via WooYun. 
• http://www.securityfocus.com/data/vulnerabilities/exploits/45546.txt
• http://www.exploit-db.com/exploits/15809/

Reference:

• http://xforce.iss.net/xforce/xfdb/64250

Why Do So Many Geeks Hate Internet Explorer?

It is a great article explaining why geeks hate IE. It will surprise you when you know that:

• IE3 ('96) introduces CSS, Java applets and ActiveX.
• IE4 ('94) introduces Dynamic HTML, Active desktop Integration, and support cross platform.
• IE5 ('99) introduces AJAX.

>>>> http://www.howtogeek.com/howto/32372/htg-explains-why-do-so-many-geeks-hate-internet-explorer/

The Security Implications Of Google Native Client

This is a wonderful post from Matasano Security about the implication of Google Native Client. This post explains in detail on the difference between the Google Native Client (NaCl) and ActiveX.

Read it at Matasano Security.

Danzer

Dranzer, an open source tool released by CERT.

It enables users to examine effective techniques for fuzz testing ActiveX controls in order to provide some insight into the current state of ActiveX security.