How to set kill-bit for Dell Webcam Software Bundled ActiveX Control CrazyTalk4Native.dll?

Question

A vulnerability has been discovered in CrazyTalk Web Player, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to a boundary error in the CrazyTalk4ActiveX control within the CrazyTalk4Native.dll module when handling certain properties. This can be exploited to cause a stack-basedbuffer overflow via an overly long string assigned to the"BackImage", "ScriptName", "ModelName", and "SRC" properties. Successful exploitation allows execution of arbitrary code. The vulnerability is confirmed in version 4.6.828.1. Other versions may also be affected. SOLUTION:Set the kill-bit for the ActiveX control. Reported by: Secunia software advisory.

How do I set the Kill-bit for this ActiveX Control? Will setting the kill-bit damage the registry and/or cause Dell Webcam Central's fail? Running Windows 7 Home Premium 32-bit on Dell XPS M1330.

Answer 1

Setting the kill-bit for ActiveX Control is a delicate action, recommended just in extreme cases, in order to protect your computer from an ActiveX vulnerability. A kill bit prevents and ActiveX control from loading, by making a small change to the Registry. If you modify the registry incorrectly, serious problems might occur. It is also not recommended to undo the kill action on, because you may create security vulnerabilities. First of all, you will have to determine the CLSID for the ActiveX control that you want to disable. This is a 128 bit number that represents a unique id for a software application. In order to do this, go to Start, Run and type regedit. This will open the Registry Editor. Expand HKEY_CLASSES_ROOT and CLSID. You can look after your software's CLSID manually, by examining the Default string value of the ProgID key for each of the CLSID keys in the list or contact the manufacturer. It is recommended to create a system restore point, before applying any adjustments. Go to Start> All Programs> Accessories> System Tools> System Restore, to create a restore point or use an application that has the ability to do that for you. Now you can start editing your registry. Go to HKEY_LOCAL_MACHINE> SOFTWARE> Microsoft> Internet Explorer> ActiveX Compatibility and right-click ActiveX Compatibility in the left pane. From the newly opened tab, choose NewKey and change the name of the new key to the CLSID, surrounded by curly brackets. Change the value of the Compatibility Flags DWORD value to 0x00000400 and make sure that the radio button labeled hexadecimal is selected. Hit Ok and Exit.