Re: ADODB.Stream runtime error

Microsoft, in a classic knee-jerk reaction to an exploit, decided to disable
ADODB.Stream in many environments (IE in particular.) A security patch some
months ago implemented it. See the KB:

http://support.microsoft.com/default.aspx?scid=kb;en-us;870669

<rant>

In reality, it was a meaningless, token gesture to address the fact that
someone got around to exploiting streams. Of course, MSXML.DOMDocument (et
al) also exposes an IStream interface, that could be used with equal ease to
do the same damage.

So effectively, nothing was made more secure by the change, except for,
perhaps, a tiny bit of security through obscurity. All it did is add one
more environmental annoyance for developers.

XP SP2 allegedly addressed this vulnerability at a lower level, but did they
rescind the ADODB.Stream squash? Hell no! That would make way too much
sense.

</rant>

-Mark


"chandra" <chandra@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:FE243559-8B2F-413E-8574-1566C2B0E627@xxxxxxxxxxxxxxxx
> Does anybody knows why i always get the runtime error "Automation Server
> can't create object" when excuting ActiveXObject("ADODB.Stream"),
>
> Any ideas??
>
> function callMethod(name, url, urn, arguments, security)
> {
> var xmlSoapRequest = createSOAPMessage(name, urn, arguments, security);
> var xmlHttp = new ActiveXObject("Msxml2.XMLHTTP.5.0");
>
> xmlHttp.open("POST",url,false);
> xmlHttp.setRequestHeader('Content-Type', 'text/xml; charset=utf-8');
> if (urn.charAt(urn.length-1) == '/')
> xmlHttp.setRequestHeader("SOAPAction", urn + name);
> else
> xmlHttp.setRequestHeader("SOAPAction", urn +"/"+ name);
>
> try
> {
> var oStm = createStream(xmlSoapRequest.xml, "utf-8");
> xmlHttp.send(oStm);
> }
>
> Catch (e)
> {
> err = new Error();
> err.name = L_sErrorName_Text;
> err.message = L_sErrorMessage_Text;
> err.innerError = e;
> throw err;
> }
> return parseResponse(xmlHttp.responseXML, name, urn);
> }
>
> function createStream(strBuf, strCharset)
> {
> var stm = null;
> var stmReader = new ActiveXObject("ADODB.Stream");
> stmReader.Type = 2; // 2 = Text
> stmReader.Open();
> stmReader.WriteText(strBuf);
>
> stm = new ActiveXObject("ADODB.Stream");
> stm.Open();
> stm.Type = 2;
> stm.Charset = strCharset;
>
> stmReader.Position = 0;
> stm.WriteText(stmReader.ReadText());
> stmReader.Close();
>
> return stm;
> }
>


.

Relevant Pages