Re: How to Break Windows XP SP2 + Internet Explorer 6 SP2

In essence this appears to point to 2 holes, at paras e and f.

I don't pretend to understand e.

f however is a simple workaround for ADODB.Stream inaccessibility, and
shows that ADODB.Connection is just as dangerous as ADODB.Stream.
Disabling ADODB.Connection blocks it, but unfortunately, unlike
ADODB.Stream which is rarely used, disabling the connection object will
blow holes in a lot of Intranet software (including where I work).
Anyway, fwiw ADODB.Connection is blocked by doing what it says in kb
article 870669 and doing what it says substituting
{00000514-0000-0010-8000-00AA006D2EA4} for
{00000566-0000-0010-8000-00AA006D2EA4}.
Or here's the reg file to block it:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX
Compatibility\{00000514-0000-0010-8000-00AA006D2EA4}]
"Compatibility Flags"=dword:00000400

Steve

--
NTBugtraq Editor's Note:

Want to reply to the person who sent this message? This list is configured such 
that just hitting reply is going to result in the message coming to the list, 
not to the individual who sent the message. This was done to help reduce the 
number of Out of Office messages posters received. So if you want to send a 
reply just to the poster, you'll have to copy their email address out of the 
message and place it in your TO: field.
--