MS03-032: August 2003 Cumulative Patch for Internet Explorer

• A vulnerability that involves the Internet Explorer cross-domain security model. The Internet Explorer cross-domain security model keeps windows of different domains from sharing information. This flaw could result in the execution of script in the My Computer zone. To exploit this flaw, an attacker would have to host a malicious Web site that contained a Web page that is designed to exploit this particular vulnerability and then persuade a user to visit that site. After the user has visited the malicious Web site, the attacker could run a malicious script by misusing the method that Internet Explorer uses to retrieve files from the browser cache, and cause that script to access information in a different domain. In the worst case, this could enable the Web site operator to load malicious script code onto a user's system in the context of the My Computer zone. Additionally, this flaw could also enable an attacker to run an executable file that was already present on the local system or to view files on the computer. The flaw exists because a file from the Internet with a maliciously-constructed URL can appear in the browser cache that is running in the My Computer zone.
• A vulnerability that occurs because Internet Explorer does not correctly determine an object type that is returned from a Web server. It could be possible for an attacker who exploited this vulnerability to run arbitrary code on a user's system. If a user visited an attacker's Web site, the attacker could exploit this vulnerability without any other user action. An attacker could also craft an HTML e-mail message that tried to exploit this vulnerability.
• A vulnerability that was discovered in the BR549.dll ActiveX control. This patch sets the Kill bit on the BR549 ActiveX control (CLSID: 167701E3-FDCF-11D0-A48E-006097C549FF). This control implemented support for the Microsoft Windows Reporting Tool, which is no longer supported by Internet Explorer. The control has been found to contain a security vulnerability, and, to protect customers who have this control installed, the patch prevents the control from running or from being reintroduced onto users' systems by setting the Kill bit for this control. For additional information about the Kill bit, click the following article number to view the article in the Microsoft Knowledge Base:
  240797� How to Stop an ActiveX Control from Running in Internet Explorer

Mitigating Factors

• By default, Internet Explorer on Windows Server 2003 runs in Enhanced Security Configuration. This default configuration of Internet Explorer helps to block these attacks. If Internet Explorer Enhanced Security Configuration has been disabled, its protections that help to prevent these vulnerabilities from being exploited are removed.
• In the Web-based attack scenario, the attacker would have to host a Web site that contained a Web page to exploit these vulnerabilities. An attacker would have no way to force users to visit a malicious Web site outside the HTML e-mail vector. Instead, the attacker would have to lure them there, typically by getting them to click a link that would take them to the attacker's site.
• Code that is executed on the system would only run under the rights of the logged-on user.

• As with the previous Internet Explorer cumulative patch that was released with security bulletin MS03-020 (818529), this cumulative patch also sets the Kill bit on the following ActiveX controls:
  
  
  Collapse this tableExpand this table

  Description	File Name	CLSID	Reference
  Microsoft HTML Help control	Hhctrl.ocx	ADB880A6-D8FF-11CF-9377-00AA003B7A11	323255�
  ActiveX Plugin control	Plugin.ocx	06DD38D3-D187-11CF-A80D-00C04FD74AD8	813489�
  DirectX Files Viewer control	XWeb.ocx	{970C7E08-05A7-11D0-89AA-00A0C9054129}	810202�

  
  
  For additional information about the Kill bit, click the following article number to view the article in the Microsoft Knowledge Base:
  240797� How to Stop an ActiveX Control from Running in Internet Explorer
• Because this patch sets the Kill bit on the Microsoft HTML Help control, you may experience broken links in Help if you have not installed the updated HTML Help control from Microsoft Knowledge Base article 811630. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
  811630� HTML Help Update to Limit Functionality When It Is Invoked with the window.showHelp( ) Method
• As with the previous Internet Explorer cumulative patches that were released with security bulletins MS03-004 (810847), MS03-015 (813489), and MS03-020 (818529), this cumulative patch causes the window.showHelp method to stop functioning if you have not applied the HTML Help update. If you have installed the updated HTML Help control from Microsoft Knowledge Base article 811630, you can still use HTML Help functionality after you apply this update. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
  811630� HTML Help Update to Limit Functionality When It Is Invoked with the window.showHelp( ) Method

Download Information

Installation Information

• Confirm that Q822925 is listed in the Update Versions field in the About Internet Explorer dialog box. You cannot use this method on Windows Server 2003 or on Windows XP 64-Bit Edition, Version 2003 because the package does not update the Update Versions field for these operating systems.
• Compare the versions of the updated files on your computer to the files that are listed in the "File Information" section in this article.
• Confirm that the following registry entries exist.
  • Windows Server 2003 and Windows XP 64-Bit Edition, Version 2003:
    
    Confirm that the
    Installed
    DWORD value with a data value of 1 appears in the following registry key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\KB822925
  • All other versions of Windows:
    
    Confirm that the
    IsInstalled
    DWORD value with a data value of 1 appears in the following registry key:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{377483c2-e4b4-4ee8-b577-9aed264c8735}

Prerequisites

Restart Requirements

Previous Update Status

Setup Switches

• /? Show the list of installation switches.
• /u Use Unattended mode.
• /f Force other programs to quit when the computer shuts down.
• /n Do not back up files for removal.
• /o Overwrite OEM files without prompting.
• /z Do not restart when installation is complete.
• /q Use Quiet mode (no user interaction).
• /l List installed hotfixes.
• /x Extract the files without running Setup.

• /q: Use Quiet mode or suppress messages when the files are being extracted.
• /q:u: Use User-Quiet mode. User-Quiet mode presents some dialog boxes to the user.
• /q:a Use Administrator-Quiet mode. Administrator-Quiet mode does not present any dialog boxes to the user.
• /t: path Specify the location of the temporary folder that is used by Setup or the target folder for extracting files (when using /c).
• /c Extract the files without installing them. If /t: path is not specified, you are prompted for a target folder.
• /c: path Specify the path and the name of the Setup .inf file or the .exe file.
• /r:n Never restart the computer after installation.
• /r:i Prompt the user to restart the computer if a restart is required, except when this switch is used with the /q:a switch.
• /r:a Always restart the computer after installation.
• /r:s Restart the computer after installation without prompting the user.
• /n:v Do not check version. Use this switch with caution to install the update on any version of Internet Explorer.

File Information

Internet Explorer 6 (32-Bit) for Windows Server 2003

   Date         Time   Version            Size    File name
   --------------------------------------------------------------
   05-Aug-2003  22:37  6.0.3790.64     2,917,376  Mshtml.dll   RTMGDR    
   05-Aug-2003  22:37  6.0.3790.59     1,394,176  Shdocvw.dll  RTMGDR
   05-Aug-2003  22:37  6.0.3790.75       509,440  Urlmon.dll   RTMGDR
   05-Aug-2003  22:35  6.0.3790.72     2,917,376  Mshtml.dll   RTMQFE
   05-Aug-2003  22:35  6.0.3790.59     1,394,176  Shdocvw.dll  RTMQFE
   05-Aug-2003  22:35  6.0.3790.75       509,440  Urlmon.dll   RTMQFE

Internet Explorer 6 (64-Bit) for Windows Server 2003 64-Bit Versions and Windows XP 64-Bit Edition, Version 2003

   Date         Time   Version            Size    File name    Platform   Folder
   -----------------------------------------------------------------------------
   05-Aug-2003  22:37  6.0.3790.64     8,209,920  Mshtml.dll       IA64   RTMGDR
   05-Aug-2003  22:37  6.0.3790.59     3,359,744  Shdocvw.dll      IA64   RTMGDR
   05-Aug-2003  22:37  6.0.3790.75     1,271,808  Urlmon.dll       IA64   RTMGDR
   05-Aug-2003  22:37  6.0.3790.64     2,917,376  Wmshtml.dll      X86    RTMGDR
   05-Aug-2003  22:37  6.0.3790.59     1,394,176  Wshdocvw.dll     X86    RTMGDR
   05-Aug-2003  22:37  6.0.3790.75       509,440  Wurlmon.dll      X86    RTMGDR
   05-Aug-2003  22:30  6.0.3790.72     8,209,920  Mshtml.dll       IA64   RTMQFE
   05-Aug-2003  22:30  6.0.3790.59     3,359,744  Shdocvw.dll      IA64   RTMQFE
   05-Aug-2003  22:30  6.0.3790.75     1,271,808  Urlmon.dll       IA64   RTMQFE
   05-Aug-2003  22:35  6.0.3790.72     2,917,376  Wmshtml.dll      X86    RTMQFE
   05-Aug-2003  22:35  6.0.3790.59     1,394,176  Wshdocvw.dll     X86    RTMQFE
   05-Aug-2003  22:35  6.0.3790.75       509,440  Wurlmon.dll      X86    RTMQFE

Internet Explorer 6 SP1 (32-Bit) for Windows XP SP1, Windows XP, Windows 2000 SP3, Windows 2000 SP4, Windows NT 4.0 SP6a, Windows Millennium Edition, and Windows 98 Second Edition

   Date         Time   Version            Size    File Name
   --------------------------------------------------------------
   13-Jul-2003  20:02  6.0.2800.1226   2,793,472  Mshtml.dll       
   23-May-2003  17:15  6.0.2800.1203   1,338,880  Shdocvw.dll      
   13-Jul-2003  20:05  6.0.2800.1226     395,264  Shlwapi.dll      
   13-Jul-2003  20:03  6.0.2800.1226     483,840  Urlmon.dll    

Internet Explorer 6 SP1 (64-Bit) for Windows XP 64-Bit Edition, Version 2002

   Date         Time     Version           Size     File Name
   --------------------------------------------------------------
   07/13/2003  03:18 PM  6.0.2800.1226  9,078,784   Mshtml.dll     
   05/23/2003  12:39 PM  6.0.2800.1203  3,648,000   Shdocvw.dll    
   07/13/2003  03:27 PM  6.0.2800.1226  1,095,168   Shlwapi.dll    
   07/13/2003  03:24 PM  6.0.2800.1226  1,412,096   Urlmon.dll

Internet Explorer 6 (32-Bit) for Windows XP

   Date         Time   Version            Size    File Name
   --------------------------------------------------------------
   17-Jun-2003  22:20  6.0.2730.1700   2,762,752  Mshtml.dll       
   11-Jul-2003  14:59  6.0.2722.900       34,304  Pngfilt.dll      
   05-Mar-2002  00:09  6.0.2715.400      548,864  Shdoclc.dll      
   22-May-2003  22:49  6.0.2729.2200   1,336,320  Shdocvw.dll      
   11-Jul-2003  14:59  6.0.2730.1200     391,168  Shlwapi.dll      
   11-Jul-2003  14:59  6.0.2715.400      109,568  Url.dll          
   11-Jul-2003  14:57  6.0.2731.1000     481,792  Urlmon.dll       
   06-Jun-2002  17:38  6.0.2718.400      583,168  Wininet.dll

Internet Explorer 5.5 SP2 for Windows 2000 SP4, Windows 2000 SP3, Windows NT 4.0 SP6a, Windows Millennium Edition, and Windows 98 Second Edition

   Date         Time   Version         Size       File name
   ----------------------------------------------------------
   17-Jun-2003  22:03  5.50.4930.1700  2,759,440  Mshtml.dll 
   17-Oct-2002  00:01  5.50.4922.900      48,912  Pngfilt.dll
   22-May-2003  23:09  5.50.4929.2200  1,149,200  Shdocvw.   
   12-Jun-2003  20:24  5.50.4930.1200    300,816  Shlwapi.dll
   05-Mar-2002  01:53  5.50.4915.500      84,240  Url.dll   
   10-Jul-2003  20:23  5.50.4931.1000    451,344  Urlmon.dll
   06-Jun-2002  21:27  5.50.4918.600     481,552  Wininet.dll
 

Internet Explorer 5.01 for Windows 2000 SP4 and SP3

   Date         Time   Version            Size    File name
   --------------------------------------------------------------
   18-Jun-2003  00:32  5.0.3806.1700   2,281,744  Mshtml.dll       
   12-Jun-2003  23:15  5.0.3806.1200      48,912  Pngfilt.dll      
   12-Jun-2003  23:08  5.0.3806.1200   1,099,536  Shdocvw.dll      
   12-Jun-2003  23:07  5.0.3806.1200     279,824  Shlwapi.dll      
   05-Mar-2002  01:53  5.50.4915.500      84,240  Url.dll          
   12-Jun-2003  23:16  5.0.3806.1200     409,360  Urlmon.dll       
   12-Jun-2003  23:16  5.0.3806.1200     445,200  Wininet.dll   

• When you install this security patch on a Windows Server 2003-based or Windows XP 64-Bit Edition Version 2003-based computer, the installer checks to see if any of the files that are being updated on your computer have previously been updated by a Microsoft hotfix. If you have previously installed a hotfix to update one of these files, then the installer copies the RTMQFE files to your computer. Otherwise, the installer copies the RTMGDR files to your computer. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
  824994� Description of the Contents of a Windows Server 2003 Product Update Package
• Because of file dependencies and Setup or removal requirements, these update packages may also contain additional files.

Removal Information

• /? Show the list of installation switches.
• /u Use Unattended mode.
• /f Force other programs to quit when the computer shuts down.
• /z Do not restart when installation is complete.
• /q Use Quiet mode (no user interaction).

• /? Show the list of supported switches.
• /z Do not restart when installation is complete.
• /q Use Quiet mode (no user interaction).

Known Issues

• After you apply the cumulative security patch for Internet Explorer that is included in Microsoft Security Bulletin MS03-032, you may receive the following error message when you try to visit Web pages that are opened by JavaScript functions in frames or in windows:
  HTTP 404 - File not found
  For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
  827667� "HTTP 404 - File Not Found" Error Message When You Try to Visit Web Pages That Are Opened by JavaScript Functions in Frames or in Windows
• After you install this patch, you may receive the following error message when any request is made to ASP.NET 1.0 running on Windows XP:
  Server Application Unavailable
  For additional information about this issue, click the following article number to view the article in the Microsoft Knowledge Base:
  827641� BUG: "Server Application Unavailable" Error Message from ASP.NET After You Install the MS03-032 Security Update
• You may receive the following error message when you try to remove this patch:
  There was an error in trying to uninstall the patch.
  This problem may occur if you have the Baan Front Office Client installed. The Baan Front Office Client adds information to the Path string value in the following registry key:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE
  To resolve this problem, follow these steps:
  1. Click Start, click Run, type regedit, and then click OK.
  2. Locate and click the following registry key:
     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE
  3. Right-click the Path string value, and then click Modify.
  4. In the Value data box, remove the semicolon (;) and any text that appears after "Internet Explorer." For example, the Value data box should contain text similar to the following:
     
     
     C:\Program Files\Internet Explorer
• To correctly remove (uninstall) more than one cumulative update for Internet Explorer on a computer that is running Windows Server 2003 or Windows XP 64-Bit Edition, Version 2003, you must remove the updates in the same order that they were installed. For example, if you install 818529, and then install 822925, you must remove 822925 before you remove 818529.
• On a Windows 2000-based or on a Windows XP-based computer, you can install the 813489 or the 818529 critical update after you install the 822925 critical update. If you do this, the updated files in the 822925 critical update are replaced by the older files in the 813489 or the 818529 critical updates. To resolve this issue, reinstall the 822925 critical update.
• You can install the Internet Explorer 5.5 SP2 version of the 822925 critical update on a Windows 2000 SP3-based computer that is running Internet Explorer 5.01 SP3. To resolve this issue, remove the Internet Explorer 5.5 SP2 version of the 818529 critical update, and then install the Internet Explorer 5.01 SP3 version of the 818529 critical update. Administrators can use the Ieuninst.exe tool to remove the Internet Explorer 5.5 SP2 update. For more information, see the "Removal Information" section of this article. For example, to remove the update quietly, use the following command:
  c:\windows\ieuninst /q c:\windows\inf\q818529.inf
  Note This command assumes that Windows is installed in the C:\Windows folder.
• On a computer that is running Windows XP, Windows 2000, Windows NT, Windows Millennium Edition, or Windows 98 Second Edition, after you remove the 818529 critical update, you cannot remove previous cumulative updates for Internet Explorer (such as the 813489 critical update). This behavior is by design. Removing is supported only for the last cumulative update that you installed.
• For additional information about known issues that may occur after you install this update, click the following article number to view the article in the Microsoft Knowledge Base:
  325192� Issues After You Install Updates to Internet Explorer or Windows