MS13-090: Cumulative security update for ActiveX Kill Bits: November 12, 2013

Microsoft has released security bulletin MS13-090. To view the complete security bulletin, go to one of the following Microsoft websites:

• Home users:
  
  http://www.microsoft.com/security/pc-security/updates.aspx
  Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Website now:
  
  http://update.microsoft.com/microsoftupdate/
• IT professionals:
  
  http://technet.microsoft.com/security/bulletin/MS13-090

How to obtain help and support for this security update

Help installing updates:
Support for Microsoft Update

Security solutions for IT professionals:
TechNet Security Troubleshooting and Support

Help protect your computer that is running Windows from viruses and malware:
Virus Solution and Security Center

Local support according to your country:
International Support

Windows XP (all editions)

Reference Table

The following table contains the update information for this software.
Note The update for supported versions of Windows XP Professional x64 Edition also applies to supported versions of Windows Server 2003 x64 Edition.

Windows Server 2003 (all editions)

Reference Table

The following table contains the update information for this software.
Note The update for supported versions of Windows Server 2003 x64 Edition also applies to supported versions of Windows XP Professional x64 Edition.

Windows Vista (all editions)

Reference Table

The following table contains the update information for this software.

Windows Server 2008 (all editions)

Reference Table

The following table contains the update information for this software.

Windows 7 (all editions)

Reference Table

The following table contains the update information for this software.

Windows Server 2008 R2 (all editions)

Reference Table

The following table contains the update information for this software.

Windows 8 and Windows 8.1 (all editions)

Reference Table

The following table contains the update information for this software.

Windows Server 2012 and Windows Server 2012 R2 (all editions)

Reference Table

The following table contains the update information for this software.

Windows RT and Windows RT 8.1 (all editions)

Reference Table

The following table contains the update information for this software.

Detection and Deployment Tools and Guidance

Several resources are available to help administrators deploy security updates.

• Microsoft Baseline Security Analyzer (MBSA) lets administrators scan local and remote systems for missing security updates and common security misconfigurations.
• Windows Server Update Services (WSUS), Systems Management Server (SMS), and System Center Configuration Manager help administrators distribute security updates.
• The Update Compatibility Evaluator components that are included with the Application Compatibility Toolkit help in streamlining the testing and validation of Windows updates against installed applications.

For information about these and other tools that are available, see Security Tools for IT Pros.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows

How to allow the vulnerable ActiveX control to run in Internet Explorer

After you install this security update, kill bits are set that prevent the vulnerable InformationCardSigninHelper Class ActiveX control from instantiating in Internet Explorer. You can undo the kill bits to allow the vulnerable ActiveX control to run in Internet Explorer.

Warning Reverting the kill bits will allow the vulnerable ActiveX control to run in Internet Explorer and will remove the protections that are provided by this update.

To undo the kill bits, follow these steps:

1. Paste the following text in a text editor such as Notepad. Then, save the file as a .reg file (such as undoKB2900986.reg).
   

   
   Windows Registry Editor Version 5.00
   [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{19916e01-b44e-4e31-94a4-4696df46157b}] 
   
   
   [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{19916e01-b44e-4e31-94a4-4696df46157b}] 
   
   
   [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{c2c4f00a-720e-4389-aeb9-e9c4b0d93c6f}] 
   
   
   [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{c2c4f00a-720e-4389-aeb9-e9c4b0d93c6f}] 
   
   
   [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{53001f3a-f5e1-4b90-9c9f-00e09b53c5f1}] 
   
   
   [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{53001f3a-f5e1-4b90-9c9f-00e09b53c5f1}] 

2. Double-click this .reg file to apply it to individual systems. You can also apply it across domains by using Group Policy. For more information about Group Policy, see the TechNet article, Group Policy collection.
   
   
   Note You must restart Internet Explorer for the changes to take effect.

How to prevent the vulnerable ActiveX control from instantiating in Internet Explorer

If you want to reinstate the kill bits that prevent the vulnerable ActiveX control from instantiating in Internet Explorer, follow these steps:

1. To set the kill bits for CLSIDs with the values of {19916e01-b44e-4e31-94a4-4696df46157b}, {c2c4f00a-720e-4389-aeb9-e9c4b0d93c6f}, and {53001f3a-f5e1-4b90-9c9f-00e09b53c5f1}, paste the following text in a text editor such as Notepad. Then, save the file as a .reg file (such as applyKB2900986.reg).
   

   
   Windows Registry Editor Version 5.00
   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{19916e01-b44e-4e31-94a4-4696df46157b}] 
   
   "Compatibility Flags"=dword:04000400 
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{19916e01-b44e-4e31-94a4-4696df46157b}] 
   
   "Compatibility Flags"=dword:04000400 
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{c2c4f00a-720e-4389-aeb9-e9c4b0d93c6f}] 
   
   "Compatibility Flags"=dword:04000400 
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{c2c4f00a-720e-4389-aeb9-e9c4b0d93c6f}] 
   
   "Compatibility Flags"=dword:04000400 
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{53001f3a-f5e1-4b90-9c9f-00e09b53c5f1}] 
   
   "Compatibility Flags"=dword:00000400 
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{53001f3a-f5e1-4b90-9c9f-00e09b53c5f1}] 
   
   "Compatibility Flags"=dword:04000400 

2. Double-click this .reg file to apply it to individual systems. You can also apply it across domains by using Group Policy. For more information about Group Policy, see the TechNet article, Group Policy collection.
   
   
   Note You must restart Internet Explorer for the changes to take effect.