Re: ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)]

["Bojan Zdrnja" <bojan.zdrnja () gmail com>]

On 9/26/06, Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]
<sbradcpa () pacbell net> wrote:
> Jesper's Blog : More options on protecting against recent IE
> vulnerabilities on a domain:
> http://msinfluentials.com/blogs/jesper/archive/2006/09/22/More-options-on-protecting-against-the-VML-vulnerability-on-a-domain.aspx
>
> I like that option better.  Leaves me supported and honestly I've not
> seen anything that I'm running that's used VML or freaked since I've
> done that?

Btw, there seems to be a small issue with unregistering the vgx.dll.

When you unregister this DLL, among the other things it also removes
the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Version Vector

There are two values this key has:

"IE" = "6.0000"
"VML" = "1.0"

When you re-register vgx.dll, it only recreates the VML value, and
doesn't recreate the IE value.

I'm not sure where this is used, but it could be wise to save this key
before unregistering the DLL (it's easy to recreate it though).

Bojan

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/