MS08-022: Vulnerability in the VBScript and JScript scripting engines could allow remote code execution

View products that this article applies to.

INTRODUCTION

Microsoft has released security bulletin MS08-022. The security bulletin contains all the relevant information about the security update. This information includes file manifest information and deployment options. To view the complete security bulletin, visit one of the following Microsoft Web sites:

Home users:
http://www.microsoft.com/protect/computer/updates/bulletins/200804.mspx
Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:
http://update.microsoft.com/microsoftupdate/
IT professionals:
http://www.microsoft.com/technet/security/bulletin/ms08-022.mspx

How to obtain help and support for this security update

Help installing updates:
Support for Microsoft Update

Security solutions for IT professionals:
TechNet Security Troubleshooting and Support

Help protect your computer that is running Windows from viruses and malware:
Virus Solution and Security Center

Local support according to your country:
International Support

↑ Back to the top

Known issues with this security update

Issue 1

Symptoms

You install this security update on a Microsoft Windows 2000-based computer that is running a version of Microsoft Internet Explorer that is earlier than Microsoft Internet Explorer 5.5. When you do this, a script that uses features from VBScript 5.0 or a later version of VBScript does not work.

For example, you run a script that uses a feature that is provided by VBScript 5.0 or a later version of VBScript, such as RegExp. When you do this, you may receive an error message that resembles the following error message:

Library is not registered.

Cause

This issue occurs because the installer file for this security update does not add a registry entry that is associated with the new VBScript.dll file.

Workaround

To work around this issue, open a command prompt, type the following command, and then press ENTER:

Regsvr32 vbscript.dll

Issue 2

A setup issue was causing the update for VBScript 5.6 and JScript 5.6 to not be offered, and not installed, if Windows Internet Explorer 7 is installed on the system. The solution is a detection change to this security update. Customers who have successfully updated their systems do not need to reinstall this update.

File information

The English (United States) version of this security update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

For all supported editions of Microsoft Windows 2000 Service Pack 4

File name	File version	File size	Date	Time	Platform
Jscript.dll	5.6.0.8835	458,752	05-Jan-2008	11:05	x86
Vbscript.dll	5.6.0.8835	401,408	05-Jan-2008	11:05	x86

For all supported 32-bit versions of Windows XP

File name	File version	File size	Date	Time	Platform	SP requirement	Service branch
Jscript.dll	5.6.0.8835	450,560	18-Dec-2007	14:40	x86	SP2	SP2GDR
Vbscript.dll	5.6.0.8835	417,792	18-Dec-2007	14:40	x86	SP2	SP2GDR
Jscript.dll	5.6.0.8835	450,560	18-Dec-2007	14:32	x86	SP2	SP2QFE
Vbscript.dll	5.6.0.8835	417,792	18-Dec-2007	14:32	x86	SP2	SP2QFE

For all supported x64-based versions of Windows XP Professional

File name	File version	File size	Date	Time	Platform	SP requirement	Service branch
Jscript.dll	5.6.0.8835	998,912	14-Dec-2007	22:58	x64	SP1	SP1GDR
Vbscript.dll	5.6.0.8835	662,016	14-Dec-2007	22:58	x64	SP1	SP1GDR
Wjscript.dll	5.6.0.8835	458,752	14-Dec-2007	22:58	x86	SP1	SP1GDR\WOW
Wvbscript.dll	5.6.0.8835	401,408	14-Dec-2007	22:58	x86	SP1	SP1GDR\WOW
Jscript.dll	5.6.0.8835	999,424	14-Dec-2007	22:58	x64	SP1	SP1QFE
Vbscript.dll	5.6.0.8835	662,528	14-Dec-2007	22:58	x64	SP1	SP1QFE
Wjscript.dll	5.6.0.8835	458,752	14-Dec-2007	22:58	x86	SP1	SP1QFE\WOW
Wvbscript.dll	5.6.0.8835	401,408	14-Dec-2007	22:58	x86	SP1	SP1QFE\WOW
Jscript.dll	5.6.0.8835	999,936	14-Dec-2007	23:10	x64	SP2	SP2GDR
Vbscript.dll	5.6.0.8835	663,040	14-Dec-2007	23:10	x64	SP2	SP2GDR
Wjscript.dll	5.6.0.8835	458,752	14-Dec-2007	23:10	x86	SP2	SP2GDR\WOW
Wvbscript.dll	5.6.0.8835	401,408	14-Dec-2007	23:10	x86	SP2	SP2GDR\WOW
Jscript.dll	5.6.0.8835	999,936	14-Dec-2007	22:58	x64	SP2	SP2QFE
Vbscript.dll	5.6.0.8835	663,040	14-Dec-2007	22:58	x64	SP2	SP2QFE
Wjscript.dll	5.6.0.8835	458,752	14-Dec-2007	22:58	x86	SP2	SP2QFE\WOW
Wvbscript.dll	5.6.0.8835	401,408	14-Dec-2007	22:58	x86	SP2	SP2QFE\WOW

For all supported 32-bit versions of Windows Server 2003

File name	File version	File size	Date	Time	Platform	SP requirement	Service branch
Jscript.dll	5.6.0.8835	458,752	14-Dec-2007	08:34	x86	SP1	SP1GDR
Vbscript.dll	5.6.0.8835	401,408	14-Dec-2007	08:34	x86	SP1	SP1GDR
Jscript.dll	5.6.0.8835	458,752	14-Dec-2007	08:00	x86	SP1	SP1QFE
Vbscript.dll	5.6.0.8835	401,408	14-Dec-2007	22:54	x86	SP1	SP1QFE
Jscript.dll	5.6.0.8835	458,752	14-Dec-2007	08:34	x86	SP2	SP2GDR
Vbscript.dll	5.6.0.8835	401,408	14-Dec-2007	08:34	x86	SP2	SP2GDR
Jscript.dll	5.6.0.8835	458,752	14-Dec-2007	08:41	x86	SP2	SP2QFE
Vbscript.dll	5.6.0.8835	401,408	14-Dec-2007	08:41	x86	SP2	SP2QFE

For all supported x64-based versions of Windows Server 2003

File name	File version	File size	Date	Time	Platform	SP requirement	Service branch
Jscript.dll	5.6.0.8835	998,912	14-Dec-2007	22:58	x64	SP1	SP1GDR
Vbscript.dll	5.6.0.8835	662,016	14-Dec-2007	22:58	x64	SP1	SP1GDR
Wjscript.dll	5.6.0.8835	458,752	14-Dec-2007	22:58	x86	SP1	SP1GDR\WOW
Wvbscript.dll	5.6.0.8835	401,408	14-Dec-2007	22:58	x86	SP1	SP1GDR\WOW
Jscript.dll	5.6.0.8835	999,424	14-Dec-2007	22:58	x64	SP1	SP1QFE
Vbscript.dll	5.6.0.8835	662,528	14-Dec-2007	22:58	x64	SP1	SP1QFE
Wjscript.dll	5.6.0.8835	458,752	14-Dec-2007	22:58	x86	SP1	SP1QFE\WOW
Wvbscript.dll	5.6.0.8835	401,408	14-Dec-2007	22:58	x86	SP1	SP1QFE\WOW
Jscript.dll	5.6.0.8835	999,936	14-Dec-2007	23:10	x64	SP2	SP2GDR
Vbscript.dll	5.6.0.8835	663,040	14-Dec-2007	23:10	x64	SP2	SP2GDR
Wjscript.dll	5.6.0.8835	458,752	14-Dec-2007	23:10	x86	SP2	SP2GDR\WOW
Wvbscript.dll	5.6.0.8835	401,408	14-Dec-2007	23:10	x86	SP2	SP2GDR\WOW
Jscript.dll	5.6.0.8835	999,936	14-Dec-2007	22:58	x64	SP2	SP2QFE
Vbscript.dll	5.6.0.8835	663,040	14-Dec-2007	22:58	x64	SP2	SP2QFE
Wjscript.dll	5.6.0.8835	458,752	14-Dec-2007	22:58	x86	SP2	SP2QFE\WOW
Wvbscript.dll	5.6.0.8835	401,408	14-Dec-2007	22:58	x86	SP2	SP2QFE\WOW

For all supported Itanium-based versions of Windows Server 2003

File name	File version	File size	Date	Time	Platform	SP requirement	Service branch
Jscript.dll	5.6.0.8835	1,304,576	14-Dec-2007	22:58	IA-64	SP1	SP1GDR
Vbscript.dll	5.6.0.8835	1,116,160	14-Dec-2007	22:58	IA-64	SP1	SP1GDR
Wjscript.dll	5.6.0.8835	458,752	14-Dec-2007	22:58	x86	SP1	SP1GDR\WOW
Wvbscript.dll	5.6.0.8835	401,408	14-Dec-2007	22:58	x86	SP1	SP1GDR\WOW
Jscript.dll	5.6.0.8835	1,306,624	14-Dec-2007	23:00	IA-64	SP1	SP1QFE
Vbscript.dll	5.6.0.8835	1,116,672	14-Dec-2007	23:00	IA-64	SP1	SP1QFE
Wjscript.dll	5.6.0.8835	458,752	14-Dec-2007	23:00	x86	SP1	SP1QFE\WOW
Wvbscript.dll	5.6.0.8835	401,408	14-Dec-2007	23:00	x86	SP1	SP1QFE\WOW
Jscript.dll	5.6.0.8835	1,306,624	14-Dec-2007	23:09	IA-64	SP2	SP2GDR
Vbscript.dll	5.6.0.8835	1,116,672	14-Dec-2007	23:09	IA-64	SP2	SP2GDR
Wjscript.dll	5.6.0.8835	458,752	14-Dec-2007	23:09	x86	SP2	SP2GDR\WOW
Wvbscript.dll	5.6.0.8835	401,408	14-Dec-2007	23:09	x86	SP2	SP2GDR\WOW
Jscript.dll	5.6.0.8835	1,306,624	14-Dec-2007	23:00	IA-64	SP2	SP2QFE
Vbscript.dll	5.6.0.8835	1,116,672	14-Dec-2007	23:00	IA-64	SP2	SP2QFE
Wjscript.dll	5.6.0.8835	458,752	14-Dec-2007	23:00	x86	SP2	SP2QFE\WOW
Wvbscript.dll	5.6.0.8835	401,408	14-Dec-2007	23:00	x86	SP2	SP2QFE\WOW

↑ Back to the top

Applies to:

↑ Back to the top

Keywords: kbsecreview, kbexpertiseinter, kbexpertisebeginner, kbmustloc, kblangall, kbqfe, kbsecurity, kbsecbulletin, kbsecvulnerability, kbbug, kbfix, kbpubtypekc, kb

↑ Back to the top

Article Info

Article ID	:	944338
Revision	:	4
Created on	:	4/17/2018
Published on	:	4/17/2018
Exists online	:	False
Views	:	163

Microsoft KB Archive Search

MS08-022: Vulnerability in the VBScript and JScript scripting engines could allow remote code execution

INTRODUCTION

How to obtain help and support for this security update

Known issues with this security update

Issue 1

Symptoms

Cause

Workaround

Issue 2

File information

For all supported editions of Microsoft Windows 2000 Service Pack 4

For all supported 32-bit versions of Windows XP

For all supported x64-based versions of Windows XP Professional

For all supported 32-bit versions of Windows Server 2003

For all supported x64-based versions of Windows Server 2003

For all supported Itanium-based versions of Windows Server 2003

Applies to: