GRC | Security Now! Notes for Episode #61

Resource links for Security Now! Episode #61:

ISP Privacy and Security

RioSec Security Weblog
A useful blog posting about the first of two recently discovered — but now patched with Tuesday's (10/10/06) updates — 0-day WebViewFolderIcon setSlice vulnerability.
Microsoft's UNPATCHED DirectAnimation vulnerability acknowledgement
This Microsoft page acknowledges the vulnerability, but does not mention that this vulnerability is now being actively exploited on the Net. It may be that A/V signature updates will catch this, but if you are an Internet Explorer user who surfs with scripting enabled, you may also wish to set the "KillBit" for the affected ActiveX control to prevent its use by IE (see links below).
A page about the second unpatched DirectAnimation vulnerability and exploit.
"How to stop an ActiveX control from running in Internet Explorer"
Microsoft's page explaining how to set an ActiveX control's "KillBit" to prevent the control's use by Internet Explorer.

The easy-to-use "ZProtector" from the terrific ZERT folks will do this for you easily, but you can also do it by hand. If you choose to do it manually, you will need the control's "CLSID" (Class ID) which is a Microsoft-format GUID (Globally Unique ID). It is:

{D7A7D7C3-D47F-11D0-89D3-00A0C90833E6}

Note that as we said in the podcast, you can also use a non-IE browser without ActiveX, or disable scripting under IE.

Also note that for Microsoft Windows XP-based and Windows Server 2003-based computers, administrators can use Software restriction policies to prevent an ActiveX control from running in any programs on computers in an Active Directory domain environment.
The ZERT main page (1.57 MB)
This ZERT page contains the latest info on their work to mitigate the dangers from the unpatched DIrectAnimation vulnerability.

Please note that the ZERT page also has a link to a patch created by "Determina" for the "WebViewFolderIcon setSlice" vulnerability which was officially patched by Microsoft on Tuesday. So the Determina patch is no longer necessary and should not be used if you have brought your system to current patch levels with Microsoft's Windows Update. You only need to use ZERT's ZProtector to disable the second and still unpatched "DirectAnimation Path" function in Internet Explorer.
Click to download ZERT's ZProtector (.zip) (167 KB)
This link will download the current ZProtector from ZERT. This is a ZIP file containing both a GUI and Command Line version of their tool to easily disable the still-unpatched and potentially dangerous DirectAnimation ActiveX control.

If you use ZProtector to disable the DirectAnimation ActiveX control while awaiting an official patch from Microsoft, you will need to remember to use it again (and we'll remind you) once this latest problem as been repaired.