Slashdot Mirror
Unpatched Firefox 1.5 Exploit Made Public
ThatGuyGreg writes "C|Net is reporting that an unpatched exploit in Firefox 1.5 has been made public, making it very easy for ne'er-do-well-sites to cause your browser to crash on startup with a single visit. Until a patch is released, it is recommended that you disable your history.dat file."
I can report that the exploit doesn't work on FC4, with the latest 1.5 built from source.
I'm still using Internet Explorer!
If it's already happened to you, just delete your history.dat file in your profile folder, and FireFox will create a new (empty) one on startup.
"Unpatched firefox 1.5 exploit made public recently by an unknown source who refused to name himself or other..." *crash*
PGP KeyId: 0x08D63965
Dat file will be history, man.
One more reason to work on mess that the history.dat file format is!
--
Superb hosting 2400MB Storage, 120GB bandwidth, ssh, $7.95
If this only crashes Firefox, how is it an "exploit"? I tend to use "exploit" as something that an attacker can use to their advantage to do something malicious. This is just an annoyance to have to move my poor cursor back to the icon and issue an oh-so-painful double-click.
today is spelling optional day.
Sounds like a great opportunity to show off the snazzy automatic incremental update feature Firefox 1.5 has. Pushing a fix quickly to users who've got it enabled would be great.
Switch back to Slashdot's D1 system.
Cheers,
Toby Haynes
Anything I post is strictly my own thoughts and doesn't necessarily have anything to do with the opinions of IBM.
The 'exploit' seems only capable of a Denial of Service. There's no proof to indicate that malicious code could be executed.
Plus, read this (from the article):
"We have gotten no independent verification that it crashes (Firefox), but there have been a lot of attempts to try," Schroepfer said.
So, this is all very hypothetical then?
This slashdot-related signature is a stub. You can help kihjin by expanding it.
thats what thet get for making an extension that runs explorer within firefox https://addons.mozilla.org/extensions/moreinfo.php ?application=firefox&id=1419
*ducks*
This isn't even related to security. Its just a bug.... lots of apps crash when something happens. Doesn't mean its ok, but it doesn't represent a security issue does it? (Unless I'm missing something...)
Notice it says "crash browser" and not "crash computer" or "fill with spyware".
Those of us with sturdy tin hats already have our histories disabled. Take that, evil!
Is it just me or is this a pretty worthless report? I can't really see this as being an exploit anyone would care about unless you happen be work for a certain company in Redmond.
Getting my machined 0wned is one thing, but I just can't have my browser crashing.
Quote from the bottom of the article:
Correction: This story incorrectly stated the affiliation of Mike Schroepfer, Mozilla's results in verifying the Firefox 1.5 flaw, and the nature of the problem. Schroepfer is vice president of engineering with Mozilla Corp., and Mozilla has not been able to verify its browser can crash and lead to a denial-of-service condition. The problem itself was a not security vulnerability but actually a flaw in the browser.
Read the article before you consider posting it with a sensational title!
Before someone starts saying Firefox is vulnerable to exploits just as IE, this exploits crashes the browser and only that, now compare this to IE's execution of arbitrary code.
No software is perfect, but still, Firefox is clearly ahead.
The IT section color scheme sucks.
This will be a good test for the new Update System that was implemented in Firefox 1.5. Too bad it will need to be utilized so soon.
With the speed that the Firefox developers release their fixes and the ease of getting those fixes with the new system, I hope this will develop as proof of how well Firefox can handle these situations.
--
Brandon Petersen
http://www.brandonpetersen.com/
With the spotlight on Firefox, it's obvious a lot more crackers and hackers are going to start looking at Mozilla Foundation's code. While previously there was little incentive for crackers to exploit vulnerabilities in MoFo's code, you can't say that now, with all the attention Firefox caught.
It's up to them to fix their software as soon as vulnerabilities are reported now.
This seems to be a good test for the new "automatic update" feature in FF 1.5. I hope they can use this feature to address these security issues in a timely manner without all this fanfare.
The guy who reported it called it a 'buffer overflow' and clearly had no understanding of what it actually meant.
which
most users won't figure out.
this proof of concept will only prevent someone from reopening
their browser after being exploited. DoS if you will. however, code
execution is possible with some modifcations.
Tested with Firefox 1.5 on Windows XP SP2.
ZIPLOCK
-->
heh
function ex() {
var buffer = "";
for (var i = 0; i ZIPLOCK says CLICK ME
When an app crashes (firefox does quite often for me) it means that it is doing something that the programmer didn't expect. That could be all sorts of things, from taking all the cpu, to writing to memory that it shouldn't be. Most overflow exploits started as mere crashes.
concrete5: a cms made for marketing, but strong enough for geeks.
Wow, that is accurate reporting, which was then amplified in the summary to the point of absurdity.
Sig under construction since 1998.
This is, in my opinion, just an example of the downside to popularity. As more and more people begin to use firefox, more and more people will find ways to break it. I use both firefox and iexplore on different machines, for the simple reason that on my new laptop, iexplore does not render images properly, and firefox was the easiest fix. I do not believe in zealotry, especially for web browsers, since firefox is losing some security it had due to obscurity. This is relatively minor news, but I think it's just the beginning of equalization between the browsers.
Empahsis mine.
What's all that about then?
Our diversity is our strength
I have winxp machine with FX 1,5 and after clicking on the link nothing realy happends .. i mean sure uses a lot of cpu but i open a new tab close previous and everything works fine... i dot knnow where's the exxploit part ;].
If thats an exploitn i think most OS are vunerable to my 31337 exploit while(1);
I ran the proof of concept on my installation of 1.0.7 (WinXP SP2) and it crashed the next time I opened FF. Task Manager showed that FF was eating up the memory like crazy. I deleted the history.dat file (which was 10 MB in size!!!!!!!) and sanity returned instantly :)
Do older versions of Firefox and Mozilla have this problem?
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Mozilla has not been able to verify its browser can crash and lead to a denial-of-service condition. The problem itself was a not security vulnerability but actually a flaw in the browser.
There are 10 kinds of people in the world - those who understand binary and those who don't
In other news: Water is wet. Seriously, whoever wrote the history code needs to be shot. Once your history gets to any significant size, all operations on it start getting annoyingly slow. For me, it takes 15 seconds for firefox to open the Go menu for the first time in a session, and once you've done that, even more annoyingly there's a delay of a few seconds on every new page you visit for the rest of that session. The history sidebar is so excruciatingly slow it's practically unusable.
Preferences > privacy > history > [0] days; ok.
Patched. I use the history feature about twice a year, won't miss it till the right fix is found.
Not quite like disabling all the javascript in MSIE, is it?
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
"Users have to kill out of the browser and start over again. This stalled browser creates a DOS (denial of service) condition," Ullrich said.
:(. And 1.0.7 is working just great for now.
This reminds of all those horrible years of Netscape 4.x on Solaris desktop environments when the CPU usage would spike to 95% thanks to Netscape and Netscape would need to be killed
The browser crashes when I go to a site? OMG! If its not arbitrary code execution, don't bother me. IE has had a similar exploit since it came out. Basically, it crashes randomly when visiting a website.
"The problem itself was a not security vulnerability but actually a flaw in the browser."
I think a security vulnerability is a flaw in any program, and the use of said term was unnecessary.
-Mr. Chicken
It'd be nice to mention how to disable the history.dat file.
"C|Net is reporting that an unpatched exploit in Firefox 1.5 has been made public, making it very easy for ne'er-do-well-sites to cause your browser to crash on startup with a single visit.
Would that explain why all of a sudden firefox would hang every time I try to visit Howard Forums.
Another tip for you: if you remove the gas pedal from your car, you won't have any crashes! Really!
DOWNLOADING MORE SOFTWARE to intentionally disable part of a program that is supposed to work is 150% unacceptable.
Jesus, how bad does software have to get before people finally start to not use it? Luckily, I didn't pay anything for my Firefox installations, so I can't really bitch. But I CAN look at other, less buggy alternatives (like IE) that also offer useful features that Firefox doesn't, like Active X.
If you're caught on such a trick you deserve teh haxor, b0y!
Slashdot's the only website I go to!
:)
(Oh yeah... the links, and the ads...)
(Oh and those other 3 news websites...)
(And...
That's my favorite comment in at least a week.
I recognize that it can cause inconvenience, but come on. Exploits in IE typically result in executing arbitrary code on the user's computer. I guess this is just another argument as to why system diversity is important. If no browser had more than 20% of the market it'd be difficult to target a large portion of internet users.
However, it does become a security issue if the crash leads to the possibility to execute code on the local system, or if it permanently cripples the browser, as it does in this case.
I've seen a few "normal" crash bug reported as security issues, and I think that's rather silly and might end up mudding the waters, so to speak. If people cry wolf too many times, and it turns out that it's just a crash, which we all know happen, and they can't be exploited, then people will go "oh, it's just another crash" when a real issue is revealed. Such as this one.
My first reaction when I heard about this was "what? Another crasher reported as a security flaw? When will it all end?!" But then I read more to see if I was missing something, and it turned out to be a real issue.
It might not be a big deal to those of us who know how to work around it, but imagine one of the many novice users out there being caught by this flaw. They may dump Firefox and never look back.
Has anyone changed from firefox to opera perhaps? I've been hearing from several people that firefox can be a pain the ass at certain times, like crashes at random times, closing your browser with multiple TABS and giving you errors after closing it, several bugs,.. it also uses quite alot of memory, and this happens with my firefox too, I guess I'll give opera a try. -- http://www.e-guides.biz/
Does "editor" need to be changed to "poster"? One would think titles, dupes, and blatently fake (or copied) stories wouldn't make /., although as of late, there has been a disturbing trend...
Regardless of what these so called "analysts" like to say, it causes a browser to crash - it doesn't allow any code to execute, or, allow some remote worm ream your system...
what is meant by "disable".
Is the author suggesting we remove write access? Rename the file? I don't follow. "disable" is ambiguous.
Rendered using Microsoft's *NEW* CSS/Teenager parsing utility:
Now, I definitely agree that normal crash bugs are NOT security issues, but in this case the browser won't start properly unless you erase the history, and all those novice Firefox switchers won't know that this workaround exists. As such, this bug, if it is actually there, will cripple Firefox for a large number of users.
False alarm. No security-related concerns, just overenthusiastic reporting.
If you run the script below, it will create a page with a title that's quite huge. Close your browser and open it again. The browser will spin for about 2 minutes what it tries to make sense the contents of your history file. Once it's finished, you'll be back up and running, with no degradation in performance or visible side-effects. You'll be able to even view your browsing history (including the offending page). In fact, I'm posting this response after following the process described above (on WinXP), and I have a history entry entitled "AAAAAAAAAAAAAAAAA..."
A bit of an annoyance, but hardly a security issue.
Here's the official exploit code:
"With sufficient thrust, pigs fly just fine. However, this is not necessarily a good idea...."
RFC 1925
I have my 1.5 version set to delete all history/caches automatically (it is an internal feature). I don't recall if it happened at startup or shutdown of the app (I'm assuming startup).
Would that be a viable workaround (especially for those who don't care about/want history)?
Diplomacy is the art of saying, "Nice doggie!" until you can find a rock.
C|Net has added the following correction at the end of the story:
"Correction: This story incorrectly stated the affiliation of Mike Schroepfer, Mozilla's results in verifying the Firefox 1.5 flaw, and the nature of the problem. Schroepfer is vice president of engineering with Mozilla Corp., and Mozilla has not been able to verify its browser can crash and lead to a denial-of-service condition. The problem itself was not a security vulnerability but actually a flaw in the browser."
So Firefox crashes, but no security vunerabilty.
Jumpstart the tartan drive.
If there is a fix for the insane memory leak that Firefox has. After installing 1.5, it gets up to 150M usage after a couple of hours with just 3-8 tabs open. After using the same instance for about half a day or so it's at 350M and the whole OS slows down until you close it and start another one. Even IE never did that crap to me. It's a shame.
So are you trying to say it's a feature?
> But I CAN look at other, less buggy alternatives (like IE)
Heheh, made me laugh out loud!
In the Web 2.0 world, timely Firefox patches are going to be increasing neccesary. With Web 2.0 technologies such as AJAX and Ruby on Rails, security is going to become a top priority. With such synergestic software as Firefox, you can be sure that Web 2.0 will be the best web ever.
sites which cause your browser to crash with a single visit
Yeah, sounds like a wonderful way of generating traffic and boosting google revenue.
The claim of a buffer overflow is nonsense. I suspect that that claim is a joke. The only thing that makes this mild borking work is a very long document title. In setting that up, the author uses a variable called "buffer" and "buffer2". Just because a JS variable gets named "buffer2" and gets set to something very long doesn't make this a buffer overflow. I like to think that the guy must be joking, instead of actually being that stupid.
But in the end, there is a bug to be fixed in Firefox
Prime numbers are exactly what Alan Greenspan says they are -S. Minsky
"No, the history hasn't been cleared because I've been looking at porn! It's the exploit, I tells ya! The exploit!"
Is "Historymon" one of the new Digimon or something?
read the whole article theres a correction at the bottom lol
Just tell all your buddies on AIM: lol no this is not an exploit
I love how this is considered Informative.
What? Oh, Jamaicans say "mon" instead of "man". I should write that important information down. Maybe it should be added to http://en.wikipedia.org/wiki/Jamaican_English.
Keep that information flowin', mon! Irie!
Shabba!
You know where you are? You're in the $PATH, baby. You're gonna get executed!
You forgot to use leverage as a verb.
Should be modded Informative.
I'm running Firefox 1.0.7 on Kubuntu (Breezy Badger) and it doesn't crash here. It definitely hung for a good long while on the next startup while it tried to parse the history file, but it did eventually start up normally.
It seems that the problem is somehow related to the windowmanager. Firefox passes the value of the title string to the windowmanager on startup which tries to display it in the window title. This fails if the string is very long, depending on the window manager. If you use MWM then firfox starts with no problem, despite a delay because of the time needed to load the bloated history.
Can anyone approve this?
Sven
There is no security breach involved here at all. It's not even a very bad bug. Clicking an infected link (as I've done) doesn't crash your browser, it doesn't keep it from reopening, it doesn't cause a buffer overflow. All it does is make Firefox take a unusually long time to open the next time. Admittedly, an inexperienced or impatient person might think this is a crash , but it's really not.
f ox-1.5-buffer-overflow.txt (note that this is a text file. It needs to be changed to HTML and have a link clicked to work.)
P.S. The original code is found at http://packetstormsecurity.org/0512-exploits/fire
P.P.S. I'm using Firefox 1.5 on Windows XP SP2, both of them fully updated.
Big deal, it's not like my browser is part of the operating system. /wink
Tyranny isn't the worst enemy of a democracy. Cynicism is.
This assumes that you can actually force the exploit without javascript. If Firefox clips HTML titles then the vulnerability would be much less severe. Of course, as soon as someone figures out a way to turn the buffer overrun into an arbitrary code execution this jumps to the top of the pile... remind me, why are we still using unchecked buffers in a zero-trust application like a web browser?
Help poke pirates in the eyepatch, arr.
The .js code didn't crash my browser, an I did indeed have a history entry called AAAAA(...), so nuts to that.
:)
On the other hand, though, having a 12MB history file DID slow the browser down considerably, especially while the history window itself was open.
I suppose, then, that if you managed to create a 500MB header, that would cause some computers extreme issues, but it desn't sound like it could be used for a buffer overrun, because Firefox does actually seem to be interpreting the huge topic correctly.
Maybe we should all start using Mosaic. After all, I don't know of any Mosaic exploits.
History file "history.dat" (for Windows users), is under
. If you've created a profile, "history.dat" will be in the directory bearing the same name. If you're using the default profile, it will be in the "default.XXX" directory, where "XXX" is some random set of characters.The Russians have won. They have made the world a cesspool of distrust, greed, fear and hate.
Works fine for me, using Firefox 1.5 on WinXP (Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5). I also have Macromedia Flash Player 8,0,220,0 and QuickTime 7.0.2a63 installed, although I don't know whether they are invoked by the page. When I run QuickTime by itself, it says it has expired and I need to download a new version.
Firefox is just ancilliary. Really, I wish folks would get the two separate. FF on linux is not FF on windows. NOT. It's totally different. This article should be about another *windows* exploit, that happens to manifest itself when someone running WINDOWS OS and using a WINDOWS application experiences some problems.
I wish they would actually have TWO NAMES for that browser, because they are DIFFERENT THINGS. And I also wish that sometime, somewhere, a serious effort be made to make an OPEN OS ONLY browser and stop doing MS jobs for them. Doing free coding for Microsoft to make their operating system only marginally better is beyond ludicrous. You might as well become a jock* for all the good it will do.
*sorry, I normally don't cuss like that
I am by no means trying to plug gentoo, but I did just noticed that they added a patch to version 1.5 in portage to address this issue (seems to cap titles in history to 65535 bytes.
I wonder if the gentoo team plans to submit their patch upstream to mozilla...
proxy
Sorry, having just posted that, it THEN crashed when I closed the Apple tab.
While they're trying to make a patch for this, that would be nice if they thought about dropping mork aka the stupidest file format in the world to let's say, whatever database format they can find. anything but not mork, please. (ok, i'm nearly off topic)
You just got troll'd!
HA! Crash the browser by visiting a site? That has been possible with IE for years...just goes to show how behind the times open source is.
Doesn't crash mine on xp. 1.5+session saver.
Sure, the proof of concept uses JavaScript. But the problem itself has nothing to do with scripting. One could easily generate a 2.5MB HTML file with a really long title. 2 million "A"s in a row will probably compress pretty well, so if you serve it with on-the-fly compression, it doesn't have to take much extra time or bandwidth to retrieve.
Bingo: exploited with no scripting involved at all.
WAY too damn often, when i have a couple instances open loaded with tabs, the piece of shit will just spin at 100% cpu usage, totally unresponsive, and not allow me to save any tabs. don't get me started on the "obsessive update" "feature" that just wants to update like crazy every 5 minutes in some previous version; took them HOW long to fix that?
[i know it's "extra" and not to be taken for granted that people fix free software, but DAMN people, make some good use of your time or don't bother haxx0ring it. better use of your time would be to write a little doc on how people could understand the code base, and fix things properly]
while i'm on the topic, dammit, it's 2005, how hard can it be to write a program (esp with the myriad APIs like dx, gdi etc that make even the scrolling someone else's problem!) that loads, displays and maybe even saves some pages, without crashing or locking up? it's just *text and images*, what is so fancy and difficult about these browsing "engines" that hasn't been done a million times in the last who knows how many years of programming history?
being a programmer myself, i find it amazing that even though this is exactly the sort of thing we've been doing (and trained to do- oh my, have we had the training: flow charts, extreme programming, etc etc AD NAUSEUM) for yeaaaars, it STILL manages to just get worse and worse somehow! if the codebase weren't so huge and bukkake-style-coded i might been able to do something about it, perhaps even other mere mortals...
*phew*, sorry about that.
At least trusty ol' firefox has never let me down. And it's not integrated irrevocably with my desktop OS!
Kinda helps a whole lot really.
Though, MS is going a long way to "fixing" the problems with IE - we'll never get the option to uninstall it.
I am government man, come from the government. The government has sent me. -- G.I.R.
The FTA didn't make up it's mind until after the story was in the story queue for a while.
It was a correction.
A NYC lawyer blogs. http://www.chuangblog.com/
There is an easy solution to this problem, switch to Internet Explorer. Internet Explorer doesn't have this bug and it isn't cluttered by lots of useless feature bloat like tabbed browsing or silly plugins.
Add the following line to your pres.js oder enter it using the about:config dialog
e t", "noAccess");
user_pref("capability.policy.default.Title.text.s
As you can clearly see, this will disable the ability to manipulate the Document's Title with JavaScript. I already had this, and many other proactive hardenings, already implemented since a long time... in fact, almost every known security hole didn't ever apply to me.
Heh. This story is only a few hours old and look at the latest Gentoo ebuild's changelog *mozilla-firefox-1.5-r1 (08 Dec 2005) 08 Dec 2005; Jory A. Pratt +files/1.5/mozilla-firefox-1.5-history.patch, +mozilla-firefox-1.5-r1.ebuild: patch to fix history DoS So much for unpatched.
So Firefox crashes. Big deal. I crash every software I ever touch. Internet Explorer crashes when rendering a certain file that is 12 bytes long.
When someone finds a non-Javascript Firefox crash that actually executes malicious code (or just crashes after rendering a file smaller than 13 bytes), wake me up, and then I might consider it news.
In fact, I'm posting this response after following the process described above (on WinXP), and I have a history entry entitled "AAAAAAAAAAAAAAAAA..."
AAAAAAA!
Irene KHAAAAAAN!
hahahahahahahaha!
Chumps.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
There are some simple work-arounds to project yourself from this exploit.
. title.set","noAccess");
From http://isc.sans.org/diary.php?storyid=920
Go to Tools -> Options. Select the Privacy Icon, and then the History tab. Set the number of days to save pages at 0. This will disable writing anything to history.dat as far as I can tell, and should nullify the exploit. Readers have confirmed that this workaround does prevent the buffer overflow. You can also change your privacy settings to delete personal info when you close Firefox.
Another workaround is to modify prefs.js while Firefox has not been started and put in the line:
user_pref("capability.policy.default.HTMLDocument
Lastly, you can also run the NoScript extension, found here. (Which I have not looked at in depth.) However, there are other ways of exploiting this where NoScript might not work.
Some users have reported being unable to reproduce this error. I will test more to try to establish what makes this work and not. So far it appears Mac users are not affected by this.
Horns are really just a broken halo.
Its https://bugzilla.mozilla.org/show_bug.cgi?id=31900 4 (copy/paste link, Bugzille doesnt like /. Links)
. title.set","noAccess");
According to a Comment there a workaround is setting
user_pref("capability.policy.default.HTMLDocument
Soem comment and direction to work taking place about 2/3 way down
2 005-12-04-trunk-builds/#comments
http://www.squarefree.com/burningedge/2005/12/04/
The Singularity is closer than you think
Quant
Why would all those porn sites want to crash my browser when I am just about to enter my credit card number?!?!
/. each day, so I only have to read about sploits for my browser about once a month, instead of eaZ^a.%@*gd^
Damn 1.5 can't even render the two yahoo+intel pics at the top of slashdot on the reply screen. or did yahoo and intel merge and I missed it on yahoo news? or slashdot? i tell ya, this intarnet gets harder and harder to use each day. Yatel? Inthoo? Yathoo? Yathooey? Yahoo Inside? yatel.com? Schnarf.
at least I read the
Error: Connection closed by remote host. Please check your history settings.
"C|Net is reporting that an unpatched exploit in Firefox 1.5 has been made public, making it very easy for ne'er-do-well-sites to cause your browser to crash on startup with a single visit."
Why on earth would a malicious website want to do that? I'm sure there are much simpler ways of making it impossible for users to view your site.
I don't need an exploit to make Firefox 1.5 crash, it does that quite well enough by itself. Anyone else out there running 1.5 on Ubuntu Breezy and having lots of crashes?
I get a popup about something related to Quicktime missing, but the page loads up just fine.
I have no sig yet I must scream.
I have QT 7 installed too. The page pauses for a little while on load, but doesn't crash.
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Good, so you're just limited to other critical exploits... and poor rendering... and being open to spyware. Seriously, I think I'm going to block AC comments.
I don't know about this exploit. But within about 2 hours of installing FF1.5 I reverted back to 1.07. FF1.5 had SERIOUS issues with allowing checkout on several ECommerce sites. I did file a bug in bugzilla with exact steps to reproduce. But I won't move forward with FF until some of the serious issues are fixed. I wish I had time to tear into the source to fix it myself....
The Truth is a Virus!!!
The posts so far would seem to indicate that the ipod page problem is related to the QuickTime plug-in.
For the record, the page was OK for me (Firefox 1.5 on Windows 2000) with QuickTime 6.5.2, but I don't have the QuickTime browser plug-in installed.
I don't like QuickTime and/or Acrobat Reader loading within my browser, so I try never to install the plug-ins (or rather, I try to remember to remove them!).
YMMV
return 0; }
It's funny that you're correcting a jamaican impression, as jamaicans frequently do not spell things consistantly and write it down howefer dey like.
Twinstiq, game news
Cheers,
Toby Haynes
Anything I post is strictly my own thoughts and doesn't necessarily have anything to do with the opinions of IBM.
Bad idea.
You'll have to change this sooner or later. Changing it sooner is better.
You can feel free to ignore this good advice, but it *is* good advice; even Microsoft thinks you should ditch ActiveX.
nt
.
. hmmm
Comment removed based on user account deletion