Microsoft Security Advisory 2501696 and Fix it

Microsoft released Security Advisory 2501696 which relates to a publicly disclosed vulnerability in the MHTML protocol handler. The vulnerability affects all current versions of Windows except Server Core.  Because this is a Windows vulnerability, the version of IE is not relevant.  The vulnerability could allow an attacker to cause a victim to run malicious scripts when visiting various Web sites, resulting in information disclosure.

The recommendations in the Security Advisory are two-fold.  I added a third recommendation, which is to disable ActiveX with WinPatrol.

1.  Enable the MHTML protocol lockdown, which can be accomplished via the Microsoft Fix It in Microsoft KB Article 2501696. When a security update is released, undo the lockdown of MHTML.

• To lock down MHTML, Enable:  Microsoft Fix it 50602
• To undo the lockdown of MHTML, Disable:  Microsoft Fix it 50603

2. Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones.  To raise the browsing security level in Internet Explorer, follow these steps:

• Launch Internet Explorer and select the Tools menu and click Internet Options.
• Under Internet Options, select the Security tab and then click the Internet icon.
• Under Security level for this zone, move the slider to High.  (This sets the security level for all Web sites to High.

Note:  If no slider is visible, click Default Level and then move the slider to High.

Use WinPatrol to disable ActiveX

ActiveX can be disabled with WinPatrol.   By default only those controls used by Internet Explorer are displayed. WinPatrol allows you to disable ActiveX controls by setting the "Kill-bit" found in the Windows registry. Disabling a control will not delete any files from your system. You can Enable a killed control at any time in the future.

References:

• MSRC: Microsoft releases Security Advisory 2501696
• Security Research & Defense: More information about the MHTML Script Injection vulnerability
• Tech Net Advisory: Microsoft Security Advisory (2501696): Vulnerability in MHTML Could Allow Information Disclosure
• Knowledge Base Article: Microsoft Security Advisory: Vulnerability in MHTML could allow information disclosure

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...