IE vulnerability not completely covered by last patch

[fhurst]

I do hope I have come to the right place to post my
question.
It has been brought to my attention that the last patch
did not completely resolve the vulnerability issue in
Internet Explorer and that officials at the CERT
Coordination Center suggest that editing the Registry by
means of a "key" deletion or name change would bring
about the desired results. The key that needs to be
renamed or deleted is:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content
Type\application/hta.
I am somewhat of a novice but I am learning. I have made
registry changes only under the instructions of someone
knowledgeable enough to walk me through the process
therefore, I am uncomfortable at changing the name or
deleting something in there. When I opened "Regedit" and
eventually found the folder above, it contained three
entrees ("Default", "CLSID" and "Extension"). Which one
is the "Key"? Do I delete all or, change the name of all
of three? Or, Do I just change the name of the folder in
the tree view in the left window pane?

Your Friend,
fhurst

 

[Guest]

Fred,
None of them and all of them. Each one of those items
have a 'setting'. Depending on the parameters, they can
hold different information. Generally, 0 is off, 1 is
on. But they can be different from 'off' and 'on'.

Please be cautious. You sound like you're on the verge
of a very big cliff.

Good Luck,
sysadmin - anon

 

[Roger Abell]

The wording used for what is in the registry is somewhat
confusing/confused/abused - and it has shifted over time.
Keys are akin to folders, they hold other keys or they hold
entries. Entries were once call values. Entries are often
called keys - the kind of keys that only have values but can
not hold a substructure of other keys.
Confusing and confused, like I said.
What they are saying in the advisory is that if you mangle
the registration of the hta com object then it cannot be used.
You could do this by renaming the key (which holds the entries
like Default, etc), or by misnaming all of the entries.
You might want to look at www.pivx.com/qwikfix instead.
Qwik-fix seems to be preventing the unpatched parts of the
hta vulnerabilites, as well as a number of others.
If you completely disable activex and active scripting you
also will prevent most of the existing unpatched vulerabilities
of IE, as will use of an alternate browser.