Internet Explorer Binary Behaviors Security Setting

Applies To: Windows Server 2003 with SP1

What does binary behaviors security setting do?

Internet Explorer contains dynamic binary behaviors: components that encapsulate specific functionality for HTML elements to which they were attached. These binary behaviors are not controlled by any Internet Explorer security setting, allowing them to work on Web pages in the Restricted Sites zone. In Windows Server 2003 Service Pack 1, there is a new Internet Explorer security setting for binary behaviors. This new setting disables binary behaviors in the Restricted Sites zone by default. In combination with the Local Machine Lockdown security feature, it also requires administrative approval for binary behaviors to run in the Local Machine zone by default. This new binary behaviors security setting provides a general mitigation to vulnerabilities in Internet Explorer binary behaviors.

For more information about binary behaviors, such as how they work and how to implement them, see "Cutting Edge: Binary Behaviors in Internet Explorer 5.5" on the Microsoft Web site at https://go.microsoft.com/fwlink/?LinkId=21862. Note that binary behaviors, which are defined in C++ and compiled, are different from attached behaviors and element behaviors, which are defined in script.

Who does this feature apply to?

Application developers whose applications use Internet Explorer functionality in the restricted sites or local machine zones should review this feature to plan to adopt changes in their applications. For example, e-mail applications that render HTML e-mail in the Restricted Sites zone might need to be modified.

Users can only be affected by applications that do not completely render HTML content with this new setting. These applications will typically alert the user that some active behavior has been blocked from display. For example, when Outlook Express encounters this situation, it informs the user that it has restricted active content in the e-mail.

What new functionality is added to this feature in Windows Server 2003 Service Pack 1?

New Internet Explorer security setting

Detailed description

A new URL action setting, Binary and Script Behaviors, is in each Internet Explorer security zone. The default value for this setting is Enable for all zones except the Restricted Sites zone and the Locked-Down Local Machine zone. In the Restricted Sites zone, the default value is Disable. In the Locked-Down Local Machine zone, the default value is Administrator approved.

Why is this change important? What threats does it help mitigate?

This new setting helps mitigate attacks in which binary behaviors were being used maliciously and allows the user to control the use of binary behaviors on a per-zone basis.

What works differently?

Any use of any binary behaviors for HTML rendering from the Restricted Sites zone is blocked.

How do I resolve these issues?

To use binary behaviors from the Restricted Sites zone, an application will have to implement a custom security manager. (For more information, see "Creating a Customized URL Security Manager" in "Introduction to URL Security Zones" on the Microsoft Web site at https://go.microsoft.com/fwlink/?LinkId=21863.)

When the binary behaviors URL action is exercised from a custom security manager, the URL action will pass in a string representation of the particular binary behaviors that can be enabled by that custom security manager as needed for application compatibility. The following process takes place when this URL action is exercised:

• Internet Explorer calls into a custom security manager (if available), using the ProcessUrlAction method with a dwAction of URLACTION_BEHAVIOR_RUN.

• The pContext parameter points to a LPCWSTR that contains the behavior that a policy is being queried for. For example, #default#time.

• You set *pPolicy =URLPOLICY_ALLOW for your SmartTag behavior, from within your custom security manager, as appropriate.

In the absence of the custom security manager, the default action is to disallow running behaviors in the Restricted Sites zone, and to disallow running most behaviors in the Local Machine zone.

If you are a desktop administrator you can decide which binary behaviors to allow in the Locked-down Local Machine zone. To enable a behavior in the Locked-down Local Machine zone, you can add it to the list of administrator-approved behaviors as follows, replacing the namespace and behavior variables as appropriate to your environment:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedBehaviors

#%Namespace%#%Behavior%=dword:00000001

Behaviors that are defined in this list will also be used for any other zone where the binary behavior restriction setting is configured to "Admin-Allowed" (65536).

What existing functionality is changing in Windows Server 2003 Service Pack 1?

None. This is only a setting to turn on or off the existing binary behaviors functionality.

What settings are added or changed in Windows Server 2003 Service Pack 1?

Internet Explorer Binary Behaviors Settings

Do I need to change my code to work with Windows Server 2003 Service Pack 1?

If your code uses binary behaviors in the Restricted Sites zone, then you will need to change your code by implementing a custom security manager for your application. If your code uses binary behaviors in the Local Machine zone, then you will need to either implement a custom security manager, add your behaviors to the list of approved behaviors, or use Mark of the Web to load your pages in less restrictive zones. For more information, see the "Creating a Customized URL Security Manager" section in "Introduction to URL Security Zones" on the Microsoft Web site at https://go.microsoft.com/fwlink/?LinkId=21863.