2

A recently discovered vulnerability affects Internet Explorer versions up to version 9, running on Windows XP, Vista, and Windows 7.

This arstechnica article quotes HD Moore as saying,

Just keep in mind that even if you don't use IE for day-to-day browsing, a lot of tools you use do embed IE and those are vulnerable.

Assuming that I can't deploy Microsoft's Enhanced Mitigation Experience Toolkit (EMET) through a group policy, I might have to visit every machine. Each one has probably dozens of applications installed. The EMET has per-executable mitigations. For example, the mitigation for excel.exe is potentially different from the mitigation for word.exe, and so on. So I need to consider mitigation for at least one executable in every application. (Some apps have a lot more than one executable.)

To make the most effective use of time to mitigate this particular IE risk, I'd like to know which installed applications actually embed Internet Explorer. If I know which ones have IE embedded, I'd assume those were the riskiest, and I could define mitigations for those first.

At a command prompt, is there any way to tell which applications have embedded Internet Explorer? I have a fairly complete toolbox of command line tools; I can even boot a Linux live CD if I need to. But I haven't the first clue what to look for.

|improve this question|||||
  • Unfortunately, this question as it is will likely be closed. The question is rather broad, a little ambiguous, and likely to generate a list. Any lists given in answers would likely be time-sensitive, changing as new applications are written or old ones retired. There may be a useful question in this still, but at this moment I can't exactly figure out how to re-word it while still maintaining the original intent. – Iszi Sep 19 '12 at 16:59
  • @Iszi: Thanks for the guidance. I rewrote the question and the text. – Mike Sherrill 'Cat Recall' Sep 19 '12 at 18:56
  • The edit is a bit better. Perhaps though, instead of asking "which applications have IE embedded" it might be better (i.e.: less likely to generate a too-localized list) if you ask "what types of applications commonly have IE embedded". – Iszi Sep 19 '12 at 19:00
  • 1
    Knowing the types of apps won't help me manage my time. I need a waving, red flag that says, "This one's trouble." And, in my own question's defense, the edit doesn't ask which apps have IE embedded. It asks, "Is there a way to tell which apps have IE embedded?" – Mike Sherrill 'Cat Recall' Sep 19 '12 at 21:08
  • I think this is a great question. I think it should be re-opened. The question asks "is there a way to tell which applications have embedded IE?". Seems entirely on-topic, not at all ambiguous, not overly broad. I don't follow the "likely to generate a list" criticism. I don't understand why the answer is necessarily time-sensitive. From my perspective the current version of the question seems fine, and none of the criticisms sound valid to me, so I propose re-opening it. I don't know what the answer is, but it seems like a good question to me! – D.W. Sep 24 '12 at 1:35
3

There are lots of libraries that relate to the Internet Explorer functionality, and it's probably the case that anything making use of it uses others that I don't know.

Two that are signs, though, are definitely shdocvw.dll and mshtml.dll. If you see an application loading either of those libraries, you can feel pretty comfortable that it's making use of IE. Take a look at MSDN's About the Browser article.

|improve this answer|||||
2

The IE UDF uses the same settings as the IE:

Try setting the proxy to localhost using specific port (lets say 55555) and run netstat while using the computer. Record all the programs tried to access 55555, and you have a partial list.

|improve this answer|||||
0

As for as I know only Windows operating systems implement IE:

  • Windows server 2008
  • Windows 7
  • Windows server 2003
  • Windows Vista
  • Windows XP
  • Windows Phone 7
  • Windows Mobile x.x
  • Windows CE (embedded devices)

Also applications that have a browsing function (on windows) can embed internet explorer or part of its functions. So if you know you have an application that has functionalities in it that look like you are browsing a webpage (Steam and Origin have this for example (but I doubt they actually embed IE)) then you should be very careful with it.

|improve this answer|||||
  • 1
    I don't think that's what @catcall is asking, I think the question is how IE can be called on a windows box without a user explicitly clicking on IE – GdD Sep 19 '12 at 14:50
  • @GdD: You're mostly right. I want to know which applications are known to imbed IE. – Mike Sherrill 'Cat Recall' Sep 19 '12 at 15:00
  • @Catcall - If you can browse the internet then they likely are using a browser. How does knowing specific examples help you? Just patch IE and unless there is an exploit in the wild you are safe. This current exploit is nothing serious, there have been exploits in other browsers, typical IE hate for no reason. – Ramhound Sep 20 '12 at 11:30
  • @Ramhound: There are many dozens of apps, and my time is limited. Currently there are exploits in the wild, and there isn't yet a patch for IE. My edited question and comments change the context a little; I want to know how I can identify apps that embed IE, preferably from the command line. When Germany asks the public to stop using IE, it's a little bit more than the typical IE hatred. – Mike Sherrill 'Cat Recall' Sep 20 '12 at 11:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.