CWE - CWE-623: Unsafe ActiveX Control Marked Safe For Scripting (1.4)

Home > CWE List > CWE- Individual Dictionary Definition (1.4)

CWE List
Full Dictionary View
Development View
Research View
Reports

About
Sources
Process
Documents

Community
Related Activities
Discussion List
Research
CWE/SANS Top 25
CWSS

News
Calendar
Free Newsletter

Compatibility
Program
Requirements
Declarations
Make a Declaration

Contact Us
Search the Site

CWE-623: Unsafe ActiveX Control Marked Safe For Scripting

Individual Definition in a New Window

Unsafe ActiveX Control Marked Safe For Scripting

Status: Draft

Weakness ID: 623 (Weakness Variant)

Description

Summary

An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.

Extended Description

This might allow attackers to use dangerous functionality via a web page that accesses the control, which can lead to different resultant vulnerabilities, depending on the control's behavior.

Time of Introduction

Architecture and Design

Implementation

Observed Examples

Reference	Description
CVE-2006-6510	kiosk allows bypass to read files
CVE-2007-0219	web browser uses certain COM objects as ActiveX
CVE-2007-0617	add emails to spam whitelist

Potential Mitigations

During development, do not mark it as safe for scripting.

After distribution, you can set the kill bit for the control so that it is not accessible from Internet Explorer.

Weakness Ordinalities

Primary (where the weakness exists independent of other weaknesses)

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to
ChildOf	Weakness Base	267	Privilege Defined With Unsafe Actions	Development Concepts (primary)699 Research Concepts (primary)1000
ChildOf	Weakness Class	691	Insufficient Control Flow Management	Research Concepts1000
PeerOf	Weakness Base	618	Exposed Unsafe ActiveX Method	Research Concepts1000

Research Gaps

It is suspected that this is under-reported.

References

<http://msdn.microsoft.com/workshop/components/activex/safety.asp>.

<http://msdn.microsoft.com/workshop/components/activex/security.asp>.

<http://support.microsoft.com/kb/240797>.

Content History

Modifications

Eric Dalci. Cigital. 2008-07-01. (External)

updated Time_of_Introduction

CWE Content Team. MITRE. 2008-09-08. (Internal)

updated Description, Relationships, Observed_Example, Weakness_Ordinalities

Page Last Updated: May 26, 2009


	CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security. This Web site is hosted by The MITRE Corporation. Copyright 2009, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information.	Privacy policy Terms of use Contact us