# MA-109.092006: MyCERT Advisory - Microsoft Internet Explorer VML Buffer Overflow and WebViewFolderIcon ActiveX Vulnerability

**Date:** 29 Sep 2006  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-109.092006  
**Advisory ID:** MA-109.092006

---

#### 1.0 Description
#### 1.1 Overview
MyCERT had received reports of two separate critical vulnerabilities in Internet Explorer that allow a remote attacker to execute arbitrary commands. MyCERT is aware that the IE VML Buffer Overflow Vulnerability is currently being actively exploited and proof of concept exploits for both vulnerabilities have been published on the Internet.
By convincing users to open a specially crafted HTML page using either Internet Explore, Outlook or Outlook Express, a remote attacker could execute arbitrary code with privileges of the user running Internet Explorer.
On the 30th September, the WebViewFolderIcon setSlice exploit had been discovered. The WebViewFolderIcon setSlice uses the Active-X component as a vector. This can have the same effect as the previous two exploits. We have confirmed that by applying the workaround for the Active-X (see 2.4) the WebViewFolderIcon setSlice exploit can be prevented.
#### 1.2 System Affected
- Microsoft Windows
- Microsoft Internet Explorer
Details on systems and components affected are available from the respective vulnerability advisories on the vendors website.
### 2.0 Recommendations
#### 2.1 IE Vector Mark-up Language (VML) Vulnerability
Since this vulnerability is being actively exploited, MyCERT strongly recommends all vulnerable systems are updated immediately through Windows Update or Microsoft Update.
Please take note that the above fix be given priority over the workarounds (i.e. by disabling the VML component in the registry) which was previously recommended by Microsoft.
#### 2.2 Microsoft Internet Explorer WebViewFolderIcon ActiveX Vulnerability
Currently there are no updates for this vulnerability. Microsoft however has recommended workarounds to be applied in the mean time.
#### 2.3 Disable the WebViewFolderIcon ActiveX control
To protect against this specific vulnerability, disable the WebViewFolderIcon control by setting the kill bit for the following CLSID:
> {844F4806-E8A8-11d2-9652-00C04FC30871}
> {E5DF9D10-3B52-11D1-83E8-00A0C90DC849}
More information about how to set the kill bit is available in Microsoft Support Document 240797
http://support.microsoft.com/kb/240797
**CAUTION: You are strictly advised to back up your registry before editing the kill bit.**
#### 2.4 Disable ActiveX
To protect against this and other ActiveX and COM vulnerabilities, disable ActiveX in the Zone and any other zone that might be used by an attacker.
To disable ActiveX, please go to Tools --> Internet Options --> Security --> click Custom Level --> then go to ActiveX controls and plugins --> set all options to *Disable* (it is recommended to disable all options under ActiveX controls and plugins)
#### 2.4 Do Not follow Unsolicited Links
Attacks involving the afore mentioned vulnerabilities require user to load a specially crafted HTML document. Therefore do not click on unsolicited links received via email, forums or chat programs.
#### 2.5 Use Alternative Browsers
MyCERT strongly recommends that in the event where a critical vulnerability involving the browser such as these occur and updates are not available, users should consider using other browsers such as Netscape or Opera.
### References
1. Microsoft Security Advisory (925568)
http://www.microsoft.com/technet/security/advisory/925568.mspx
2. Microsoft Security Advisory (926043)
http://www.microsoft.com/technet/security/advisory/926043.mspx
3. Microsoft Security Bulletin MS06-055
http://www.microsoft.com/technet/security/bulletin/MS06-055.mspx
4. Microsoft Support Document 240797
http://support.microsoft.com/kb/240797
5. Windows Update
http://www.windowsupdate.com
6. Microsoft Update
http://update.microsoft.com
7. SANS - Internet Storm Center
http://isc.sans.org/diary.php?storyid=1742