CertiGuide to Security+  9  Chapter 2:  Communication Security (Domain 2.0; 20%)       9  2.3  The Web

2.3.4.1  Java Script 1 2 2.3.4.3  Buffer Overflows

ActiveX is a Microsoft technology for downloading miniature executable programs (generally called ActiveX controls) to client machines and then executing them to enhance the user experience of the web site. Like Java Script and Java applets, ActiveX controls are most often used to provide fancier graphics or enhanced user interface functionality, beyond what is supported by HTML.

Unlike Java Script and Java applets, ActiveX controls consist of machine code instructions, and must be specifically compiled for the processor and operating system on which they will run. This means that at this point, and probably the foreseeable future, they’re usually limited to running on Windows/Intel machines (since other processor architectures like Alpha have fallen out of favor with Microsoft). It’s possible to write ActiveX controls that will work with PocketPC devices, but due to the limitations of the PocketPC platform, and the requirement that if you do this, you’d have to have separate pages aimed to Windows/Intel and Pocket PC platforms, ActiveX controls are primarily used on the web only for Windows/Intel machines.

ActiveX technology is somewhat similar to Java technology in that both provide a way to automatically download and run programs within the web browser window, but the two differ considerably in terms of their security model. In the Java applet model, any action that might be used for suspicious purposes (such as writing a file to disk or doing other things to interact with the electronic world outside the java applet’s safe run-time “sandbox”) is considered suspect (and often denied).

2.3.4.1  Java Script 1 2 2.3.4.3  Buffer Overflows