Microsoft Security Advisory (969898)

Update Rollup for ActiveX Kill Bits

Published: Tuesday, June 09, 2009 | Updated: Wednesday, June 17, 2009

Version: 1.1

Microsoft is releasing a new set of ActiveX kill bits with this advisory.

The update includes a kill bit from a previously published Microsoft Cumulative Update:

Microsoft Visual Basic 6.0 Service Pack 6 Cumulative Update (KB957924)

The update also includes kill bits for the following third-party software:

Microgaming. This security update sets a kill bit for an ActiveX control developed by Microgaming. Microgaming has released a security update that addresses a vulnerability in the affected component. For more information and download locations, see the security release from Microgaming. This kill bit is being set at the request of the owner of the ActiveX controls. The class identifiers (CLSIDs) for this ActiveX control are as listed in the Frequently Asked Questions section of this advisory.
eBay Advanced Image Upload Component. This security update sets a kill bit for an ActiveX control developed by eBay. eBay has released a security update that addresses a vulnerability in the affected component. For more information and download locations, see the security release from eBay. This kill bit is being set at the request of the owner of the ActiveX controls. The class identifiers (CLSIDs) for this ActiveX control are as listed in the Frequently Asked Questions section of this advisory.
HP Virtual Room v7.0. This security update sets a kill bit for an ActiveX control developed by Hewlett-Packard (HP). HP has released a security update that addresses a vulnerability in the affected component. For more information and download locations, see the security release from HP. This kill bit is being set at the request of the owner of the ActiveX controls. The class identifiers (CLSIDs) for this ActiveX control are as listed in the Frequently Asked Questions section of this advisory.

For more information about installing this update, see Microsoft Knowledge Base Article 969898.

General Information

Overview

References	Identification
CVE Reference	CVE-2008-0024
Microsoft Knowledge Base Article	969898


Related Software
Microsoft Windows 2000 Service Pack 4
Windows XP Service Pack 2 and Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2
Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service pack 2

Frequently Asked Questions

Do users with a Windows Server 2008 Server Core installation need to install this update?
Users with a Windows Server 2008 Server Core installation do not need to install this update. For more information on the Server Core installation option, see Server Core. Note that the Server Core installation option does not apply to certain editions of Windows Server 2008; see Compare Server Core Installation Options.

Why does this advisory not have a security rating associated with it?
This update contains a kill bit for an update released previously in a service pack as well as kill bits for third-party controls not owned by Microsoft. Microsoft does not provide a security rating for service packs or vulnerable third-party controls.

Does this update replace the Cumulative Security Update of ActiveX Kill Bits (950760)?
No, for the purpose of automatic updating, this update does not replace the Cumulative Security Update of ActiveX Kill Bits (950760) that is described in Microsoft Security Bulletin MS08-032. Automatic updating will still offer the MS08-032 update to customers regardless of whether or not they installed this update (969898). However, customers who install this update (969898) do not need to install the MS08-032 update to be protected with all the kill bits set in MS08-032.

Why is Microsoft releasing this Update Rollup for ActiveX Kill Bits with a security advisory when previous kill bit updates were released with a security bulletin?
Microsoft is releasing this Update Rollup for ActiveX Kill Bits with an advisory because the new kill bits either do not affect Microsoft software, or had been previously set in a Microsoft software update.

Does this update contain kill bits that were previously released in an Update Rollup for ActiveX Kill Bits?
Yes, this update also includes kill bits that were previously set in Microsoft Security Advisory 960715.

Does this update contain kill bits that were previously released in an Internet Explorer security update?
No, this update does not include kill bits that were previously released in an Internet Explorer security update. We recommend that you install the latest Cumulative Security Update for Internet Explorer.

What is a kill bit?
A security feature in Microsoft Internet Explorer makes it possible to prevent an ActiveX control from ever being loaded by the Internet Explorer HTML-rendering engine. This is done by making a registry setting and is referred to as setting the kill bit. After the kill bit is set, the control can never be loaded, even when it is fully installed. Setting the kill bit makes sure that even if a vulnerable component is introduced or is re-introduced to a system, it remains inert and harmless.

For more information, see Microsoft Knowledge Base Article 240797: How to stop an ActiveX control from running in Internet Explorer.

What is a security update of ActiveX kill bits?
This security update only contains the class IDs (CLSID) of certain ActiveX controls that are the basis of this security update.

Why does this update not contain any binary files?
This update only makes changes to the registry to disable the control from instantiating in Internet Explorer.

Should I install this update if I do not have the affected component installed or use the affected platform?
Yes. Installing this update will block the vulnerable control from running in Internet Explorer.

Do I need to reapply this update if I install an ActiveX control discussed in this security update at a later date?
No, reapplying this update is not required. The kill bit will block Internet Explorer from running the control even if the control is installed at a later date.

What does this update do?
This update sets the kill bit for a list of Class Identifiers (CLSIDs).

The following Class Identifiers relate to the MSCOMM32.OCX ATL Loader control addressed in the Microsoft Visual Basic 6.0 Service Pack 6 Cumulative Update (KB957924):


Class Identifier
{648A5600-2C6E-101B-82B6-000000000014}

The following Class Identifier relates to a request by Microgaming to set the kill bit for a Class Identifier that is vulnerable. Further details can be found in the security release issued by Microgaming:


Class Identifier
{D8089245-3211-40F6-819B-9E5E92CD61A2}

The following Class Identifier relates to a request by eBay to set the kill bit for a Class Identifier that is vulnerable. Further details can be found in the security release issued by eBay:


Class Identifier
{4C39376E-FA9D-4349-BACC-D305C1750EF3}
{C3EB1670-84E0-4EDA-B570-0B51AAE81679}

The following Class Identifier relates to a request by HP to set the kill bit for a Class Identifier that is vulnerable. Further details can be found in the security release issued by HP:


Class Identifier
{00000032-9593-4264-8B29-930B3E4EDCCD}

Suggested Actions

Other Information

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

Robert Freeman of ISS X-Force for reporting the MSCOMM32.OCX ATL Loader Remote Code Execution Vulnerability (CVE-2008-0024)

Resources:

You can provide feedback by completing the form by visiting Microsoft Help and Support: Contact Us.
Customers in the United States and Canada can receive technical support from Security Support. For more information about available support options, see Microsoft Help and Support.
International customers can receive support from their local Microsoft subsidiaries. For more information about how to contact Microsoft for international support issues, visit International Support.
Microsoft TechNet Security provides additional information about security in Microsoft products.

Disclaimer:

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions:

V1.0 (June 9, 2009): Advisory published
V1.1 (June 17, 2009): Added an entry to Frequently Asked Questions to communicate that for the purpose of automatic updating, this update does not replace the Cumulative Security Update of ActiveX Kill Bits (950760) that is described in Microsoft Security Bulletin MS08-032.