Here are the fixes to patch the 2 vulnerability referenced here http://isc.sans.org/diary.php?date=2004-06-27 and here http://www.microsoft.com/security/incident/download_ject.mspx, and stop cross-zone scripting for IE without affecting daily web browsing abilities.
1. Fix the adodb.stream vulnerability so you won't download files through a web page. Modify or add the following registry key to set a kill bit on this CLSID.
2. Change the security setting for the hidden "Local Computer Zone" in IE. To show the zone you need to modify the following registry.
[HKEY CURRENT USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
"Flags"= dword:00000001
Then open up IE and go to "Tools" -> "Internet Options" -> "Security" tab -> click on the "My Computer" zone and set the "Custom" security to high.
Doing this will affect the files that you open on local machine, so if you are developing a app locally remember to switch back to medium or low security.
Here's a tip if you are a developer, add a new zone in the registry for unrestricted setting and add 127.0.0.1 and your machine name the the site.
You can add a zone by exporting one of the keys under
HKEY CURRENT USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
and modify it to your liking and add it back in the registry.
Here are the fixes to patch the 2 vulnerability referenced here http://isc.sans.org/diary.php?date=2004-06-27 and here http://www.microsoft.com/security/incident/download_ject.mspx, and stop cross-zone scripting for IE without affecting daily web browsing abilities.
1. Fix the adodb.stream vulnerability so you won't download files through a web page. Modify or add the following registry key to set a kill bit on this CLSID.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX
Compatibility\{00000566-0000-0010-8000-00AA006D2EA4}] "Compatibility
Flags"=dword:00000400
2. Change the security setting for the hidden "Local Computer Zone" in IE. To show the zone you need to modify the following registry.
[HKEY CURRENT USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
"Flags"= dword:00000001
Then open up IE and go to "Tools" -> "Internet Options" -> "Security" tab -> click on the "My Computer" zone and set the "Custom" security to high.
Doing this will affect the files that you open on local machine, so if you are developing a app locally remember to switch back to medium or low security.
Here's a tip if you are a developer, add a new zone in the registry for unrestricted setting and add 127.0.0.1 and your machine name the the site.
You can add a zone by exporting one of the keys under
HKEY CURRENT USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
and modify it to your liking and add it back in the registry.
[ reply ]