Vulnerability Note VU#234812

ActiveX

ActiveX is a technology that allows programmers to create reusable software components that can be incorporated into applications to extend their functionality. Internet Explorer is a common Windows application that makes use of ActiveX controls.

ActiveX safety determination

Internet Explorer determines if an ActiveX control is safe by querying the IObjectSafety interface of the object and by querying the Implemented Categories registry key for the control, as specified by Microsoft Knowledge Base Article 216434 and the MSDN ActiveX safety article.

ActiveX security options

Through either the IObjectSafety interface or the appropriate registry values, an ActiveX control can be marked as "safe for scripting" and/or "safe for initialization." According to the MSDN article Signing and Marking ActiveX Controls:

If you mark your control as safe for initializing, you are asserting that no matter what values are used to initialize your control, it won't do anything that would damage a user's system or compromise the user's security.

If you mark your control as safe for scripting, you are asserting that your control won't do anything to damage a user's system or compromise the user's security, regardless of how your control's methods and properties are manipulated by the Web page's script. In other words, it has to accept any method calls (with any parameters) and/or property manipulations in any order without doing anything bad.

If a remote attacker can persuade a user to access a specially crafted web page, that attacker may be able to execute arbitrary code with the privileges of the compromised user.

Apply an Update
This issue is addressed in Microsoft Security Bulletin MS06-014.

Disable the RDS.Dataspace ActiveX control in Internet Explorer

The RDS.Dataspace ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following CLSID:

{BD96C556-65A3-11D0-983A-00C04FC29E36}