J-Security Center

Title: Microsoft Internet Explorer ActiveX Control Kill Bit Bypass Vulnerability

Severity: HIGH


ActiveX controls are COM objects designed to be used in Internet Explorer and invoked through a web page. If an ActiveX control contains a security vulnerability, it can be deactivated through the use of a kill bit. Before instantiating a control, Internet Explorer checks the value of the 'Compatibility Flags' registry entry. If the value of this entry is DWORD 00000400, Internet Explorer will not use the control.

Internet Explorer does not properly check the kill bit on ActiveX controls. A remote attacker could construct an HTML page that bypasses the kill bit check on any embedded ActiveX controls within the page. This could allow an unsafe ActiveX control with a known vulnerability to be invoked. The impact of the vulnerability depends on the ActiveX control being invoked; consequences may range from denial of service to arbitrary code execution.

Affected Products:

  • Microsoft Internet Explorer 5.0.1
  • Microsoft Internet Explorer 5.0.1 SP1
  • Microsoft Internet Explorer 5.0.1 SP2
  • Microsoft Internet Explorer 5.0.1 SP3
  • Microsoft Internet Explorer 5.0.1 SP4
  • Microsoft Internet Explorer 5.5
  • Microsoft Internet Explorer 5.5 SP1
  • Microsoft Internet Explorer 5.5 SP2
  • Microsoft Internet Explorer 6.0
  • Microsoft Internet Explorer 6.0 SP1
  • Microsoft Windows ME
  • Microsoft Windows Server 2003 Datacenter Edition
  • Microsoft Windows Server 2003 Datacenter Edition Itanium
  • Microsoft Windows Server 2003 Enterprise Edition
  • Microsoft Windows Server 2003 Enterprise Edition Itanium
  • Microsoft Windows Server 2003 Standard Edition
  • Microsoft Windows Server 2003 Web Edition
  • Microsoft Windows XP Home
  • Microsoft Windows XP Professional


Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.