Security issues with browser plugins

Hi,

I'm new to the list having just learned about it today from the
Internetnews.com article.  Attached is a message that I sent to the
Bugtraq and Full-Security email lists about ActiveX security issues.  If
big changes are going to be have to be made to the way plugins work in
Internet Explorer, then it will also be a good time to clean-up many of
the well-known security problems with ActiveX controls. 

Thanks,
Richard M. Smith
http://www.ComputerBytesMan.com

-----Original Message-----
From: Richard M. Smith [mailto:rms@computerbytesman.com] 
Sent: Friday, August 29, 2003 1:18 PM
To: BUGTRAQ@SECURITYFOCUS. COM (BUGTRAQ@SECURITYFOCUS.COM)
Subject: RIP: ActiveX controls in Internet Explorer?


Hi,

As everyone knows, ActiveX controls and the <OBJECT> tag has been a big
source of security holes in Internet Explorer.  However, it looks like
support for ActiveX controls is going to be removed from Internet
Explorer.  A small company called Eolas recently won a $521 million
judgment against Microsoft for patent infringement.  The Eolas patent
covers plugins in Web pages to show multimedia content.  

The $521 million payment covers past infringement.  Because Bill Gates
loathes to pay per-copy royalties, it looks like Microsoft is going to
either partially or completely remove support for ActiveX controls in
Internet Explorer rather than pay Eolas any more money.  

This Internetnews.com article talks about the fallout from the Eolas
victory:

   http://www.internetnews.com/dev-news/article.php/3070591

Here's the Eolas patent:

http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL
&p=1&u=/netahtml/srchnum.htm&r=1&f=G&l=50&s1=5,838,906.WKU.&OS=PN/5,838,
906&RS=PN/5,838,906

(This URL will probably requiring copying and pasting into your browser
since it wraps to 2 or 3 lines.)

The W3C has set up a discussion list to talk about replacements for
ActiveX in Internet Explorer:

   http://www.w3.org/2003/08/patent

I hope that security people also join this list.  This redesign of the
Internet Explorer browser looks like the perfect time to put pressure on
Microsoft to put in place a proper security system for browser add-ins. 

Thanks,
Richard M. Smith
http://www.ComputerBytesMan.com

Received on Friday, 29 August 2003 14:52:44 UTC