Jalaj P. Jha Technical & Miscellaneous Ramblings

Can Registry be written by JavaScript

Writing about Registry it came over to me, "Is there any way to write to Registry from within an HTML page using javascript or so?". That's impossible! Browsers are expected to allow reading and writing on users machine only in cookies and ability to read/write Registry would be a security breach.

Then the second question "Is there exist any flaw in browsers that allow to write to Registry?". Now the question seems rational.

And the answer unfortunately is Yes!

As available at http://www.microsoft.com/technet/security/bulletin/ms00-075.mspx

The Microsoft VM is a virtual machine for the Win32® operating environment. It runs atop Microsoft® Windows 95, 98, Windows Me, Windows NT 4.0, or Windows 2000. It ships as part of each operating system, and also as part of Microsoft Internet Explorer. The version of the Microsoft VM that ships with Microsoft Internet Explorer 4.x and Internet Explorer 5.x contains a security vulnerability that could allow a Java applet, on a malicious web site to take any desired action on a visiting user's machine.

The Microsoft virtual machine (Microsoft VM) contains functionality that allows ActiveX controls to be created and manipulated by Java applications or applets. This functionality is intended to only be available to stand-alone Java applications or digitally signed applets. However, this vulnerability allows ActiveX controls to be created and used from a web page, or from within a HTML based e-mail message, without requiring a signed applet. If a user visited a malicious web site that exploited this vulnerability, a Java applet on one of the web pages could run any desired ActiveX control, even ones that are marked as unsafe for scripting. This would enable the malicious web site operator to take any desired action on the user's machine.

This is the same vulnerability that can be exploited from Internet Explorer or Outlook Express to not only read/write to registry calling the shell object, but do anything with your computer.

The link mentioned above announces availibility of a patch to eliminate this security vulnerability. Unfortunately a large number of users are unaware of such vulnerabilities and are prone to attacks similar to W32.Feldor.A virus (details at http://www.symantec.com/security_response/writeup.jsp?docid=2005-120316-1801-99&tabid=2)

Moral : Don't stick to old versions of your browser. New versions of software are not only intended to provide rich user experiance, they also intend to patch flaws that existed in older version.