TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
According to the ISS Real Secure 5.0 Signature Guide:
Technical
Description
This decoding recognizes when a web browser attempts to obtain a file
containing a Microsoft ActiveX control. This should only occur if a user
has Active content down-loading enabled on their web browser.
False positives
Downloading an .exe file through a web browser triggers this event. This is
intentional, because any problem caused by an ActiveX control can also be
caused by downloading an executable file from the Web.
WARNING
Using this event to prohibit all ActiveX downloading will also prohibit
downloading any .exe file from the Web.
Why this is important
It is possible that ActiveX controls can contain malicious commands. You
may want to consider disabling active content downloading on your browser.
What to do Some organizations have policies that ActiveX controls will not
be used, to protect the
organization from possible hostile applets. This decode can flag
non-compliance with a policy like this.
Refer to http://www.securityfocus.com/bid/598.html
http://www.cs.princeton.edu/sip/java-vs-activex.html
At 10:52 AM 9/18/00 +1000, Darryl Luff wrote:
>TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
>[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
>----------------------------------------------------------------------------
>
>The ActiveX signature in RealSecure triggers on attempts to download any
>.exe file according to the help file. If I get 500 log entries for this,
>does it mean that someone downloaded 500 files, or that someone downloaded a
>file that took 500 packets?
>
>Thanks.
