A vulnerability has been identified in Internet Explorer allowing malicious HTML documents such as web sites to see which components are installed.

The problem is that Internet Explorer is supposed to allowed certain components to be detected from remote, however, any component and its version can be detected by quering the CLSID using the functions "getComponentVersion" and "isComponentInstalled".

This could be exploited to learn if any vulnerable components are installed.

The vulnerability has been reported in Internet Explorer 6.0.2800.1106. Other versions may also be affected.

Solution
Disable Active Scripting, except for trusted sites.

Provided and/or discovered by
Sam Schinke

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers