After you install security update 896358, some URL schemes
are ignored when you use the URL schemes in the parameters of an HTML Help
ActiveX control.
Note This article contains information that is supplemental to the
following Microsoft Knowledge Base articles:
896358Â
(http://kbalertz.com/Feedback.aspx?kbNumber=896358/
)
MS05-026: A vulnerability in HTML Help could allow remote code execution
This issue occurs because security update 896358 includes
changes to the HTML Help ActiveX control. Previously, you could use any valid
URL scheme in a parameter tag. After you install security update 896358, only
the following URL schemes are supported:
- file
- http
- https
- ftp
- its
- ms-its
- mk:@msitstore
- hcp
Microsoft introduced this change to help reduce security
vulnerabilities in HTML Help.
Warning The symptom is an expected and intended effect of installing the
security update. This section provides a workaround to re-enable additional
schemes for business-critical programs. This workaround may make the computer
more vulnerable to the threats that security update 896358 addresses. The
safest course is not to use this workaround. If you must use this workaround,
enable only those URL schemes that your business-critical programs
require.
Warning Serious problems might occur if you modify the registry
incorrectly by using Registry Editor or by using another method. These problems
might require that you reinstall your operating system. Microsoft cannot
guarantee that these problems can be solved. Modify the registry at your own
risk.
You can use the registry to re-enable URL schemes
that you want to use in HTML Help ActiveX control parameters. For example,
suppose you want to enable the news and mailto URL schemes for use in a See
Also control. Doing this would enable the See Also control to start newsgroups
and e-mail. The following .reg file re-enables these URL schemes.
Note You can paste the following text in a text editor such as
Notepad. Then, you can save the file that uses the .reg file name extension.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
"ProtocolAllowList"="news:;mailto:"
Deploying the registry keys across a domain
We recommend that you use Group Policy to deploy the settings in
the examples earlier in this article as startup scripts. You can also deploy
these settings as logon scripts. However, this method is less desirable because
of permissions constraints.
The following steps show one way to deploy
the settings in the first example as a Group Policy startup script.
- Paste the following text into a text editor such as
Notepad.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
"ProtocolAllowList"="news:;mailto:"
- Save the file. Name the file
AllowTrustedProtocols.reg.
- Paste the following text in a text editor such as Notepad.
REGEDIT.EXE /S AllowTrustedProtocols.reg
- Save the file. Name the file
AllowTrustedProtocols.bat.
- Import this batch file into the Group Policy object (GPO).
To do this, follow these steps:
- Copy the batch file and the .reg file to the
\\DomainName\SysVol\DomainName\Policies\GUID
of the selected GPO\Machine\Scripts\Startup folder.
- On the computer on which you want to run the GPO, click
Start, click Run, type
dsa.msc, and then click OK.
- Right-click your domain, and then click
Properties.
- Click Group Policy, and then click
New.
- Type the name that you want to use for this policy, and
then press ENTER.
- Click Edit.
- Expand Computer Configuration, expand
Windows Settings, click Scripts
(Startup/Shutdown), double-click Startup in the right
panel, and then click Add in the Startup
Properties dialog box.
- Locate and then click the
AllowTrustedProtocols.bat file.
- Click Add.
- Click OK, click Yes,
click OK, and then click OK again.
This article contains information that is supplemental to
Microsoft Knowledge Base article
896358
(http://kbalertz.com/Feedback.aspx?kbNumber=896358/en-us/)
.
Overview and examples for system administrators
For more information about security update 896358 and how
you can re-enable Web applications that are affected by this update, click the
following article number to view the article in the Microsoft Knowledge Base:
896358Â
(http://kbalertz.com/Feedback.aspx?kbNumber=896358/
)
MS05-026: A vulnerability in HTML Help could allow remote code execution
Group Policy
For more information about Group Policy, visit the following
Microsoft Web sites:
Technical support for x64-based versions of Microsoft Windows
On computers that are running x64-based versions of Microsoft
Windows, you may have to adapt the instructions in the
"Resolution" section about how to modify the registry. For example, you might
have to modify a different part of the registry, depending on whether you want
to modify the 32-bit or the 64-bit functionality. For more information, click the following article number to
view the article in the Microsoft Knowledge Base:
896459Â
(http://kbalertz.com/Feedback.aspx?kbNumber=896459/
)
Registry changes in Windows x64 Edition-based operating systems
Your hardware manufacturer provides
technical support and assistance for x64-based versions
of Windows. Your hardware manufacturer provides
support because an x64-based version of Windows was included with your hardware. Your hardware manufacturer might have
customized the installation of Windows with unique components.
Unique components might include specific device drivers or might include
optional settings to maximize the performance of the hardware. Microsoft will
provide reasonable-effort assistance if you need technical help with your
x64-based version of Windows. However, you might have to contact your
manufacturer directly. Your manufacturer is best qualified to support the
software that your manufacturer installed on the hardware.
For product
information about Microsoft Windows XP Professional x64 Edition, visit the
following Microsoft Web site:
For product information about x64-based versions of Microsoft
Windows Server 2003, visit the following Microsoft Web site:
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See
Terms of Use
(http://go.microsoft.com/fwlink/?LinkId=151500)
for other considerations.