Re: iDefense COMRaider, ActiveX controls, and browser configuration

["Vladimir '3APA3A' Dubrovin" <3APA3A () SECURITY NNOV RU>]

Dear Steven M. Christey,


--Thursday, March 5, 2009, 9:41:00 PM, you wrote to bugtraq () securityfocus com:


SMC> Note that a Google search for phrases like "Initialize and script ActiveX
SMC> controls not marked as safe for scripting" with "Enable" will return an
SMC> unsettling number of documents from vendors that tell their customers to
SMC> change their browsers to these unsafe settings, in order to get their own
SMC> products to work.

SMC> Given that such a setting could affect ALL controls - not just the ones
SMC> from the original vendor who needed it - I think this needs to be factored
SMC> into any software developer's threat model.

SMC> It would be very informative for someone somewhere to do a study to see
SMC> how many browsers are running with such unsafe settings.  I wouldn't be
SMC> surprised if it's 10% or more.

Steve, ActiveX is cross-application software component. These components
are  written  for  very  different  tasks, sometimes specially to manage
hardware,  sensitive data, e.g. to extend scripting facilities of server
sofware,  etc.  Limiting  ActiveX  to safe operations only is inadequate
loss  of  functionality.  It's like blaming some non-suid administration
utility  to be insecure if used as CGI (if it's not developed to be used
in such way) and requiring _any_ utility to be safe if copied to cgi-bin
folder.

If somebody allows controls not marked safe for scripting in his browser
-  it's  like  enabling  ssh  access with pre-defined account. If vendor
recommends  to  do  so  -  you  should  make a choice between vendor and
security.



-- 
Skype: Vladimir.Dubrovin
~/ZARAZA http://securityvulns.com/