NI3
11-08-2003, 10:37 AM
TITLE:
Microsoft Internet Explorer Exposure of Installed Components
SECUNIA ADVISORY ID:
SA10155
VERIFY ADVISORY:
[Only registered and activated users can see links]
CRITICAL:
Not critical
IMPACT:
Exposure of system information
WHERE:
From remote
SOFTWARE:
Microsoft Internet Explorer 6
DESCRIPTION:
A vulnerability has been identified in Internet Explorer allowing
malicious HTML documents such as web sites to see which components
are installed.
The problem is that Internet Explorer is supposed to allowed certain
components to be detected from remote, however, any component and its
version can be detected by quering the CLSID using the functions
"getComponentVersion" and "isComponentInstalled".
This could be exploited to learn if any vulnerable components are
installed.
The vulnerability has been reported in Internet Explorer
6.0.2800.1106. Other versions may also be affected.
SOLUTION:
Disable Active Scripting, except for trusted sites.
REPORTED BY / CREDITS:
Sam Schinke
OTHER REFERENCES:
Detectable Components in Internet Explorer:
[Only registered and activated users can see links]
----------------------------------------------------------------------
Microsoft Internet Explorer Exposure of Installed Components
SECUNIA ADVISORY ID:
SA10155
VERIFY ADVISORY:
[Only registered and activated users can see links]
CRITICAL:
Not critical
IMPACT:
Exposure of system information
WHERE:
From remote
SOFTWARE:
Microsoft Internet Explorer 6
DESCRIPTION:
A vulnerability has been identified in Internet Explorer allowing
malicious HTML documents such as web sites to see which components
are installed.
The problem is that Internet Explorer is supposed to allowed certain
components to be detected from remote, however, any component and its
version can be detected by quering the CLSID using the functions
"getComponentVersion" and "isComponentInstalled".
This could be exploited to learn if any vulnerable components are
installed.
The vulnerability has been reported in Internet Explorer
6.0.2800.1106. Other versions may also be affected.
SOLUTION:
Disable Active Scripting, except for trusted sites.
REPORTED BY / CREDITS:
Sam Schinke
OTHER REFERENCES:
Detectable Components in Internet Explorer:
[Only registered and activated users can see links]
----------------------------------------------------------------------