Article ID: 870669
Article Last Modified on 11/9/2005
APPLIES TO
- Microsoft Internet Explorer 5.01 Service Pack 2
- Microsoft Internet Explorer 5.01 Service Pack 3
- Microsoft Internet Explorer 5.01 Service Pack 4
- Microsoft Internet Explorer 5.5
- Microsoft Internet Explorer 6.0
- Microsoft Internet Explorer 6.0 Service Pack 1
- Microsoft Data Access Components 2.5
- Microsoft Data Access Components 2.6
- Microsoft Data Access Components 2.7
- Microsoft Data Access Components 2.8
Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
An ADO stream object contains methods for reading and writing binary files and text files. When an ADO stream object is combined with known security vulnerabilities in Microsoft Internet Explorer, a Web site could execute scripts from the Local Machine zone. To help protect your computer from this kind of attack, you can manually modify your registry.
INTRODUCTION
An ADO stream object represents a file in memory. The stream object contains several methods for reading and writing binary files and text files. When this by-design functionality is combined with known security vulnerabilities in Microsoft Internet Explorer, an Internet Web site could execute script from the Local Machine zone. This behavior occurs because the ADODB.Stream object permits access to the hard disk when the ADODB.Stream object is hosted in Internet Explorer.
MORE INFORMATION
Any line-of-business Web application that requires a file to be loaded or to be saved to the hard disk may use the ADODB.Stream object in Internet Explorer. For example, if an intranet server hosts a form that an employee must download and fill out, the ADODB.Stream object is used to obtain the file and to save the file locally. After the user edits the file locally and submits the file back to the server, the ADODB.Stream object is used to read the file from the local hard disk and to send the file back to the server.
We strongly recommend that you use different methods to provide this functionality. For example, you may use an application or a control that requires the user to deliberately access the hard disk.
Software update information
Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
Microsoft has provided three ways to disable the ADODB.Stream object from Internet Explorer. You can use Microsoft Windows Update to update your computer, you can download an update file from the Microsoft Download Center, or you can disable the ADODB.Stream object manually.
These methods work by creating the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00000566-0000-0010-8000-00AA006D2EA4}
This registry key has a GUID for the ADODB.Stream object. When Internet Explorer recognizes this registry key, Internet Explorer does not permit the component to be started in the browser.
Important notes
- If you are running the ADODB.Stream object from a server (middle tier), disabling the ADODB.Stream object on the server does not affect ADODB.Stream object functionality with Microsoft Internet Information Services (IIS).
- If you are running the ADODB.Stream object from a client by using Internet Explorer, disabling the ADODB.Stream object stops the ADODB.Stream object from being created in Internet Explorer.
Windows Update
To install this update, visit the following Microsoft Web site:
Microsoft Download Center update
To disable the ADODB.Stream object by using a registry key update that is available from the Microsoft Download Center, visit one of the following Microsoft Web sites, depending on your operating system:
Windows XP, Windows 2000, Windows NT, Windows Server 2003
Windows 9x, Windows Me
Windows XP Version 2003, 64-Bit Edition , Windows Server 2003, 64-Bit Edition
Additional information and download instructions are available on the Microsoft Download Center Web site.
Manual process
To disable the ADODB.Stream object by manually creating the registry key, follow these steps:
- Close any open Internet Explorer browser windows.
- Click Start, and then click Run.
- In the Open box, type Regedit, and then click OK.
- In Registry Editor, locate the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility - Right-click ActiveX Compatibility, point to New, and then click Key.
- Type the following name for the key:
{00000566-0000-0010-8000-00AA006D2EA4}
- Right-click the new key, point to New, and then click DWORD Value.
- Name the value Compatibility Flags.
- In the right pane, right-click Compatibility Flags, and then click Modify.
- In the Edit DWORD Value dialog box, make sure that the Hexadecimal option is selected, type 400 in the Value data box, and then click OK.
- Close Registry Editor.
When you set the compatibility flag, the ADODB.Stream object cannot access the hard disk of your computer in Internet Explorer. However, the ADODB.Stream object can still access your hard disk outside Internet Explorer.
Important notes
When you add this registry key, only the ADODB.Stream object in Internet Explorer is affected. No other ADO objects are affected by this change.
After you apply the update, you will receive the following error message when you try to use an ADO stream object from an HTML page in Internet Explorer:
If you are running an application in a corporate intranet environment, and the corporate intranet environment currently uses the ADODB.Stream object with Internet Explorer, applying this update may cause the application to break. To restore application functionality, Microsoft recommends that you first set your Internet Explorer browser security level to High, and then you must clear the compatibility flag of the ADODB.Stream object
- To set your Internet Explorer browser security to high, follow these steps:
- In Internet Explorer, click Internet Options on the Tools menu.
- Click the Security tab. Under Select a Web content zone to specify its security settings, click Internet.
- Click Default Level, and then move the slider to High.
- Click Apply, and then click OK to close the Internet Options dialog box.
- Clear the compatibility flag of the ADODB.Stream object for Internet Explorer by setting the value to zero (0x0). Setting the value to zero (0x0) disables the key and restores functionality. To manually set the compatibility flag to zero, follow these steps:
- Click Start, and then click Run.
- In the Open box, type Regedit, and then click OK.
- In Registry Editor, locate the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00000566-0000-0010-8000-00AA006D2EA4} - In the right pane, double-click Compatibility Flags.
- In the Edit DWORD Value dialog box, make sure that the Hexadecimal option is selected, type 0 in the Value data box, and then click OK.
- Close Registry Editor.
Note You must restart Internet Explorer for your changes to take effect.
REFERENCES
For additional information about how to strengthen the Local Machine zone in Internet Explorer, click the following article number to view the article in the Microsoft Knowledge Base:
833633 How to strengthen the security settings for the Local Machine zone in Internet Explorer
For more information about Internet security, visit the following Microsoft Web site:
For additional information about how to stop ActiveX controls from running on your system, click the following article number to view the article in the Microsoft Knowledge Base:
240797 How to stop an ActiveX control from running in Internet Explorer
Additional query words: security adodb
Keywords: kbinfo kbpubtypekc atdownload KB870669
