Re: iDefense COMRaider, ActiveX controls, and browser configuration
Dear Steven M. Christey,
--Thursday, March 5, 2009, 9:41:00 PM, you wrote to bugtraq@xxxxxxxxxxxxxxxxx:
SMC> Note that a Google search for phrases like "Initialize and script ActiveX
SMC> controls not marked as safe for scripting" with "Enable" will return an
SMC> unsettling number of documents from vendors that tell their customers to
SMC> change their browsers to these unsafe settings, in order to get their own
SMC> products to work.
SMC> Given that such a setting could affect ALL controls - not just the ones
SMC> from the original vendor who needed it - I think this needs to be factored
SMC> into any software developer's threat model.
SMC> It would be very informative for someone somewhere to do a study to see
SMC> how many browsers are running with such unsafe settings. I wouldn't be
SMC> surprised if it's 10% or more.
Steve, ActiveX is cross-application software component. These components
are written for very different tasks, sometimes specially to manage
hardware, sensitive data, e.g. to extend scripting facilities of server
sofware, etc. Limiting ActiveX to safe operations only is inadequate
loss of functionality. It's like blaming some non-suid administration
utility to be insecure if used as CGI (if it's not developed to be used
in such way) and requiring _any_ utility to be safe if copied to cgi-bin
folder.
If somebody allows controls not marked safe for scripting in his browser
- it's like enabling ssh access with pre-defined account. If vendor
recommends to do so - you should make a choice between vendor and
security.
--
Skype: Vladimir.Dubrovin
~/ZARAZA http://securityvulns.com/