Feeds

Microsoft ramps up vuln ActiveX controls cull

Third-party fire and exploit block

Next gen security for virtualised datacentres

This week's Patch Tuesday update was nearly as difficult to digest as a Michael Phelp's breakfast. It contained 11 bulletins covering 26 underlying vulnerabilities, the most in two years.

With all this high-calorie content to chew through two important points about the update have gone largely overlooked. Firstly, a promised Media Player update failed to make it through quality control.

Secondly Microsoft issued ActiveX "kill-bit" controls for applications from HP and Aurigma that had been the subjects of security alerts over recent months.

A kill bit involves a registry change that prevents an ActiveX control from being loaded by Internet Explorer. The technique blocks a popular exploitation route without addressing the underlying vulnerability, which needs to be separately patched.

Microsoft is making greater use of the approach, which it only applies with the blessing of third-party developers, in what amounts to an attempt to protect slow-to-patch customers from themselves.

August's update included kill bits for two third-party applications - Aurigma Image Uploader and HP Instant Support - and constitutes the third time Microsoft has disabled third-party add-ons using the approach since April. An update in April included a kill bit for the Yahoo! Music Jukebox product and problems in the BackWeb Client embedded in the Logitech Desktop Manager were nixed by a kill bit in June.

In all four cases patches from the third-party developers themselves had been available months before the Microsoft kill-bit, so this isn't just a workaround pending the availability of updates.

More information on how kill bits work, along with their uses and limitations, can be found in an FAQ from Microsoft here.

Microsoft's basic line is that if a third-party developer finds out it has produced a vulnerable ActiveX control, it will issue a kill bit that disables the control.

Earlier this month Microsoft launched a scheme to help third-party developers to find and fix bugs in their software. The Microsoft Vulnerability Research programme, while not directly tied to the kill-bit scheme, illustrates a growing recognition in Microsoft and elsewhere that the combination of two of more vulnerabilities, which alone aren't that bad, can create a serious risk from blended threats. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Best practices for enterprise data
Discussing how technology providers have innovated in order to solve new challenges, creating a new framework for enterprise data.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?