On 6th August, Microsoft has announced that they are going to block outdated Active X control on Internet Explorer 8 and higher. The reason for this is, older version of plugins has security loopholes which makes Internet Explorer vulnerable. After the announcement, people raised their voice to extend the blocking date for older ActiveX version, as many websites and tools deployed on an enterprise environment run on those outdated plugins.
An immediate announcement to block outdated ActiveX control plugin may result into business loss. Microsoft realized this issue and has delayed the blocking date till 9th September this year. After 9th September, all outdated versions will not work with Internet Explorer.
The company has released a FAQ’s based on user’s input from around the globe regarding this update:
- Which outdated ActiveX controls are covered in this update?
No ActiveX controls will be affected when the feature is initially released in August. In September, only out-of-date Oracle Java ActiveX controls will be affected. All other ActiveX controls will continue existing behaviour.
- Will this update affect applications which use out-of-date Java outside of Internet Explorer?
No. This feature will only prompt the user when an out-of-date version of Java is loaded as an ActiveX control in Internet Explorer.
- Will this update apply to Internet Explorer on server as well as client SKUs?
Yes.
- Will this feature be part of the August Cumulative Update or be released as a separate Hotfix?
This feature will be part of the August Internet Explorer Cumulative Security Update, but no out-of-date ActiveX controls will be blocked for thirty days in order to give customers time to test and manage their environments.
- Can an enterprise disable or override the URL to which a user is taken when the Update button is clicked on the out-of-date ActiveX prompt?
The URL that the user is taken to when the Update button is clicked is stored in the versionlist.xml file and while this URL can be changed in the file any future updates to the versionlist.xml will override those changes.
- Is out-of-date Java the only ActiveX control being blocked by this feature in September?
In September, yes, only out-of-date Oracle Java ActiveX controls will be blocked by this feature. However, Internet Explorer will consider blocking additional common, but out-of-date ActiveX controls in future updates.
- Where can I find additional documentation about this feature and the group policy administrative templates?
Additional TechNet documentation and the group policy administrative templates will be available on TechNet and Download Center respectively on 8/12.
There are few more FAQ’s posted by Microsoft for enterprise user, head over to this link to learn more about it.
