After you apply the fixes that are in Microsoft Security Bulletin MS04-004 and Microsoft Knowledge Base article 832414, the Microsoft XML Parser (MSXML) user credentials may be cached. Then, MSXML may use user sessions incorrectly within a single Microsoft Internet Explorer process. For example, a user may successfully connect with the following function call:
xmlhttp.open("GET", "http://www.myserver.com/myfiles", false, "correctusername", "correctpassword")
Then, the user may notice that the following call also succeeds when it is used subsequently in the same process:
xmlhttp.open("GET", "http://www.www.myserver.com.com/myfiles", false, "incorrectusername", "incorrectpassword")
The second call should fail because the credentials are incorrect. However, the call succeeds because of changes in the default behavior of Internet Explorer after you apply the MS04-004 security update.
back to the top