Comments on: MS-DEFCON 2: Problems with the patches – and an exploit http://www.askwoody.com/2009/2298/ Woody Leonhard’s no-bull news, tips and help for Windows and Office Wed, 08 Feb 2012 17:06:02 -0500 http://wordpress.org/?v=2.8 hourly 1 By: woody http://www.askwoody.com/2009/2298/comment-page-1/#comment-603 woody Wed, 17 Jun 2009 01:25:55 +0000 #comment-603 True - but if you can PROVE that it's associated with a security patch, it's free. That's a big "if" of course. True – but if you can PROVE that it’s associated with a security patch, it’s free.

That’s a big “if” of course.

]]> By: vpone http://www.askwoody.com/2009/2298/comment-page-1/#comment-600 vpone Tue, 16 Jun 2009 15:31:15 +0000 #comment-600 more info from your link "Typically, you can use the LPK Tool to create a license package. Unfortunately, you cannot do so in this case because the new CLSIDs for the kill-bit/phoenix bit are hidden on your development machine. Only the legacy CLSIDs are available. In this case, you would need to contact Microsoft Support to generate an LPK file for you." typically microsoft support costs $259/incident more info from your link

“Typically, you can use the LPK Tool to create a license package. Unfortunately, you cannot do so in this case because the new CLSIDs for the kill-bit/phoenix bit are hidden on your development machine. Only the legacy CLSIDs are available. In this case, you would need to contact Microsoft Support to generate an LPK file for you.”

typically microsoft support costs $259/incident

]]> By: vpone http://www.askwoody.com/2009/2298/comment-page-1/#comment-599 vpone Tue, 16 Jun 2009 15:29:39 +0000 #comment-599 no Yuhong, if you were using ANY of these activex controls on a webpage you now must repackage the .lpk file with the new clsid - only problem is it reverts back to the original clsid of the control - microsoft screwed up bigtime here ! no Yuhong, if you were using ANY of these activex controls on a webpage you now must repackage the .lpk file with the new clsid – only problem is it reverts back to the original clsid of the control –

microsoft screwed up bigtime here !

]]> By: Yuhong Bao http://www.askwoody.com/2009/2298/comment-page-1/#comment-21 Yuhong Bao Wed, 25 Feb 2009 15:13:14 +0000 #comment-21 "OY! And Microsoft’s solution involves re-compiling the application. Whotta mess." No, just repackaging with the new version of the ActiveX controls. “OY! And Microsoft’s solution involves re-compiling the application. Whotta mess.”
No, just repackaging with the new version of the ActiveX controls.

]]> By: woody http://www.askwoody.com/2009/2298/comment-page-1/#comment-18 woody Wed, 25 Feb 2009 06:34:58 +0000 #comment-18 Hans - OY! And Microsoft's solution involves re-compiling the application. Whotta mess. Hans -

OY! And Microsoft’s solution involves re-compiling the application. Whotta mess.

]]> By: Yuhong Bao http://www.askwoody.com/2009/2298/comment-page-1/#comment-16 Yuhong Bao Wed, 25 Feb 2009 05:50:37 +0000 #comment-16 MS have a FAQ on the kill bits and phoenix bits: http://blogs.technet.com/swi/archive/2008/02/06/The-Kill_2D00_Bit-FAQ_3A00_-Part-1-of-3.aspx http://blogs.technet.com/swi/archive/2008/02/07/The-Kill_2D00_Bit-FAQ_3A00_-Post-2-of-3.aspx http://blogs.technet.com/swi/archive/2008/02/08/The-Kill_2D00_Bit-FAQ_3A00_-Part-3-of-3.aspx MS have a FAQ on the kill bits and phoenix bits:
http://blogs.technet.com/swi/archive/2008/02/06/The-Kill_2D00_Bit-FAQ_3A00_-Part-1-of-3.aspx
http://blogs.technet.com/swi/archive/2008/02/07/The-Kill_2D00_Bit-FAQ_3A00_-Post-2-of-3.aspx
http://blogs.technet.com/swi/archive/2008/02/08/The-Kill_2D00_Bit-FAQ_3A00_-Part-3-of-3.aspx

]]> By: Yuhong Bao http://www.askwoody.com/2009/2298/comment-page-1/#comment-15 Yuhong Bao Wed, 25 Feb 2009 05:46:11 +0000 #comment-15 "Susan Bradley at Windows Secrets Newsletter has discovered that installing last Tuesday’s Killbit patch, KB 960715 can make some Visual Basic programs toast. " Do you know what a killbit is? If you don't know, a killbit prevent execution of an ActiveX control in IE. The reason MS pushed out kill-bits in an update is that older versions of the killed ActiveX controls have security vulnerablities. Usually by the time MS releases a kill-bit update, the vendor already has released the security update for the control that fixes the vulerablity, which uses a Phoenix-bit to redirect attempts to load the old version to the new version. For example, one of the ActiveX controls that was killed by this kill-bit update was old versions of the ActiveX controls that shipped with VB6, which already was patched in MS08-070. So the remedy for this one is for the developer to install MS08-070 or KB957924 on their development machine, then redistibute the new version of the ActiveX control. More at: http://blogs.msdn.com/askie/archive/2009/02/20/certain-vb-controls-no-longer-display-on-web-pages-after-installing-kb960715.aspx “Susan Bradley at Windows Secrets Newsletter has discovered that installing last Tuesday’s Killbit patch, KB 960715 can make some Visual Basic programs toast. ”
Do you know what a killbit is? If you don’t know, a killbit prevent execution of an ActiveX control in IE. The reason MS pushed out kill-bits in an update is that older versions of the killed ActiveX controls have security vulnerablities. Usually by the time MS releases a kill-bit update, the vendor already has released the security update for the control that fixes the vulerablity, which uses a Phoenix-bit to redirect attempts to load the old version to the new version. For example, one of the ActiveX controls that was killed by this kill-bit update was old versions of the ActiveX controls that shipped with VB6, which already was patched in MS08-070. So the remedy for this one is for the developer to install MS08-070 or KB957924 on their development machine, then redistibute the new version of the ActiveX control.
More at:
http://blogs.msdn.com/askie/archive/2009/02/20/certain-vb-controls-no-longer-display-on-web-pages-after-installing-kb960715.aspx

]]> By: Paul http://www.askwoody.com/2009/2298/comment-page-1/#comment-8 Paul Mon, 23 Feb 2009 09:18:14 +0000 #comment-8 Great new format! I'm an IT professional and I refer to this site daily so massive kudos on the changes. Thanks. Paul Great new format! I’m an IT professional and I refer to this site daily so massive kudos on the changes. Thanks. Paul

]]> By: Hans Peter Guttmann http://www.askwoody.com/2009/2298/comment-page-1/#comment-4 Hans Peter Guttmann Sun, 22 Feb 2009 05:21:02 +0000 #comment-4 Among the programs toasted by the Killbit patch, KB 960715 is 'Enveloper' in WOPR 2003. Uninstalling the patch restored 100% functionality to Enveloper on Vista Ultimate SP1 32 + 64-bit systems. Yeah, I know — 2003: time and times move on, but Enveloper remains a component of Word I use almost daily. Among the programs toasted by the Killbit patch, KB 960715 is ‘Enveloper’ in WOPR 2003.

Uninstalling the patch restored 100% functionality to Enveloper on Vista Ultimate SP1 32 + 64-bit systems.

Yeah, I know — 2003: time and times move on, but Enveloper remains a component of Word I use almost daily.

]]> By: sanda http://www.askwoody.com/2009/2298/comment-page-1/#comment-3 sanda Sun, 22 Feb 2009 02:28:33 +0000 #comment-3 wow. pretty. Easy to read for still new-ish. wow. pretty. Easy to read for still new-ish.

]]>