Article ID: 818529
Article Last Modified on 11/7/2007
APPLIES TO
- Microsoft Internet Explorer 6.0, when used with:
- Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
- Microsoft Windows Server 2003, Standard Edition (32-bit x86)
- Microsoft Windows Server 2003, Web Edition
- Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
- Microsoft Windows Server 2003, Datacenter x64 Edition
- Microsoft Windows Server 2003, Enterprise x64 Edition
- Microsoft Windows Server 2003, Standard x64 Edition
- Microsoft Windows XP Home Edition
- Microsoft Windows XP Professional
- Microsoft Windows XP Media Center Edition 2002
- Microsoft Windows XP Tablet PC Edition
- Microsoft Windows XP Professional x64 Edition
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Datacenter Server
- Microsoft Windows 2000 Professional Edition
- Microsoft Windows 2000 Server
- Microsoft Windows NT Server 4.0 Standard Edition
- Microsoft Windows NT Server 4.0, Terminal Server Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows Millennium Edition
- Microsoft Windows 98 Second Edition
- Microsoft Internet Explorer 5.5, when used with:
- Microsoft Windows 2000 Service Pack 3
- Microsoft Windows 2000 Service Pack 2
- Microsoft Windows NT 4.0 Service Pack 6a
- Microsoft Windows Millennium Edition
- Microsoft Windows 98 Second Edition
- Microsoft Internet Explorer 5.01 Service Pack 3, when used with:
- Microsoft Windows 2000 Service Pack 3
Technical Update
June 5, 2003: This article was revised to add additional information to the "Known Issues" section. Also, the "Installation Information" section was revised to correct the registry information that you can use to confirm that the update that is described in this article is installed on computers that are not running Windows Server 2003.
June 12, 2003: This article was revised to add a note to the "Summary" section to indicate that this patch also sets the Kill bit on several ActiveX controls.
Table of Contents
SUMMARY
Microsoft has released a cumulative patch for Internet Explorer. This cumulative patch includes updates for the issues that are described in the following Microsoft Knowledge Base article:
813489 MS03-015: April, 2003, Cumulative Patch for Internet Explorer
This cumulative patch also addresses the following newly discovered vulnerabilities:
- There is a buffer-overrun vulnerability in Urlmon.dll that occurs because Internet Explorer does not correctly determine an object type that is returned from a Web server. An attacker might be able to exploit this vulnerability to run arbitrary code on your computer. Simply visiting an attacker's Web site might permit the attacker to exploit the vulnerability without any other action on your part. An attacker can also create an HTML e-mail message that tries to exploit this vulnerability.
- There is a flaw in Shdocvw.dll that does not implement an appropriate block on a file-download dialog box. An attacker might be able to exploit this vulnerability to run arbitrary code on your computer. Simply visiting an attacker's Web site might permit the attacker to exploit the vulnerability without any other action on your part. An attacker can also create an HTML e-mail message that tries to exploit this vulnerability.
To exploit these flaws, an attacker must host a malicious Web site that contains a Web page that is designed to exploit this specific vulnerability. The attacker then must persuade users to visit the site. To use the HTML e-mail message attack vector, the attacker must create a specially formed HTML e-mail message and send it to the recipients.
Notes
- As with the previous Internet Explorer cumulative patch that was released with bulletin MS02-015 (813489), this cumulative patch also sets the "Kill" bit on the following ActiveX controls:
Description File name CLSID Reference Microsoft HTML Help control Hhctrl.ocx ADB880A6-D8FF-11CF-9377-00AA003B7A11 323255 ActiveX Plugin control Plugin.ocx 06DD38D3-D187-11CF-A80D-00C04FD74AD8 813489 DirectX Files Viewer control XWeb.ocx {970C7E08-05A7-11D0-89AA-00A0C9054129} 810202
For additional information about the Kill bit, click the following article number to view the article in the Microsoft Knowledge Base:240797 How to Stop an ActiveX Control from Running in Internet Explorer
- Because this patch sets the Kill bit on the Microsoft HTML Help control, you may experience broken links in Help if you have not installed the updated HTML Help control from Microsoft Knowledge Base article 811630. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
811630 HTML Help Update to Limit Functionality When It Is Invoked with the window.showHelp( ) Method
- As with the previous Internet Explorer cumulative patches that were released with bulletins MS03-004 (810847) and MS02-015 (813489), this cumulative patch causes the window.showHelp method to stop functioning if you have not applied the HTML Help update. If you have installed the updated HTML Help control from Microsoft Knowledge Base article 811630, you can still use HTML Help functionality after you apply this update. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
811630 HTML Help Update to Limit Functionality When It Is Invoked with the window.showHelp( ) Method
For more information about this patch, visit the following Microsoft Web site:
MORE INFORMATION
Download Information
To download and install this update, visit the Microsoft Windows Update Web site, and then install critical update 818529:
Administrators can download this update from the Microsoft Download Center or from the Windows Update Catalog to deploy to multiple computers. If you want to obtain this update to install later on one or more than one computer, search for this article ID number by using the Advanced Search Options feature in the Windows Update Catalog. For additional information about how to download updates from the Windows Update Catalog, click the following article number to view the article in the Microsoft Knowledge Base:
323166 HOW TO: Download Windows Updates and Drivers from the Windows Update Catalog
To download this update from the Microsoft Download Center, visit the following Microsoft Web site:
For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591 How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.
Installation Information
You must be logged on as an administrator to install this update. To download and install this update, visit the Windows Update Web site and install critical update 818529:
To install a downloaded version of this update, run the Q818529.exe file that you downloaded by using the appropriate setup switches. Administrators can deploy this update by using Microsoft Software Update Services (SUS). For additional information about SUS, click the following article number to view the article in the Microsoft Knowledge Base:
810796 Software Update Services Overview white paper available
To verify that this update has been installed on your computer, use any of the following methods:
- Confirm that Q818529 is listed in the Update Versions field in the About Internet Explorer dialog box. Note that you cannot use this method on Windows Server 2003 or on Windows XP 64-Bit Edition Version 2003 because the Update Versions field is not updated by the package for these operating systems.
- Compare the versions of the updated files on your computer to the files that are listed in the "File Information" section in this article.
- Confirm that the following registry entries exist.
Windows Server 2003 and Windows XP 64-Bit Edition Version 2003:
Confirm theInstalled
DWORD value with a data value of 1 in the following registry key:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\KB818529
All other versions of Windows:
Confirm theIsInstalled
DWORD value with a data value of 1 in the following registry key:HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{f5de1b93-9d38-416b-b09e-aa85a8e84309}
Prerequisites
Microsoft has tested the versions of Windows and the versions of Internet Explorer that are listed in this article to assess whether they are affected by these vulnerabilities, and to confirm that the update that is described in this article addresses these vulnerabilities.
To install the Internet Explorer 6 for Windows Server 2003 versions of this update, you must be running Internet Explorer 6 (version 6.00.3790.0000) on Windows Server 2003 (32-bit or 64-bit), or on Windows XP 64-Bit Edition Version 2003.
To install the Internet Explorer 6 Service Pack 1 (SP1) versions of this update, you must be running Internet Explorer 6 SP1 (version 6.00.2800.1106) on Windows XP 64-Bit Edition Version 2002, Windows XP SP1, Windows XP, Windows 2000 Service Pack 2 (SP2), Windows 2000 Service Pack 3 (SP3) , Windows NT 4.0 Service Pack 6a (SP6a), Windows Millennium Edition (Me), or Windows 98 Second Edition.
To install the Internet Explorer 6 version of this update, you must be running Internet Explorer 6 (version 6.00.2600.0000) on Windows XP.
To install the Internet Explorer 5.5 version of this update, you must be running Internet Explorer 5.5 SP2 (version 5.50.4807.2300) on Windows 2000 SP2, Windows 2000 SP3, Windows NT 4.0 SP6a, Windows Millennium Edition, or Windows 98 Second Edition.
To install the Internet Explorer 5.01 version of this update, you must be running Internet Explorer 5.01 SP3 (version 5.00.3502.1000) on Windows 2000 SP3.
Note Versions of Windows and versions of Internet Explorer that are not listed in this article are either in the extended phase of the product life cycle or no longer supported. Although you can install some of the update packages that are described in this article on these versions of Windows and Internet Explorer, Microsoft has not tested these versions to assess whether they are affected by these vulnerabilities, or to confirm that the update that is described in this article addresses these vulnerabilities. Microsoft recommends that you upgrade to a supported version of Windows and Internet Explorer, and then apply the appropriate update. If you are running a version of Windows or of Internet Explorer that is in the extended phase of the product life cycle and you have an Extended Support Contract, contact your Technical Account Manager (TAM) or Applications Development Consultant (ADC) for information about an update for your configuration. For additional information about how to determine which version of Internet Explorer you are running, click the following article number to view the article in the Microsoft Knowledge Base:
164539 How to Determine Which Version of Internet Explorer Is Installed
For additional information about support lifecycles for Windows components, visit the following Microsoft Web site:
For additional information about how to obtain Internet Explorer 6 SP1, click the following article number to view the article in the Microsoft Knowledge Base:
328548 How to Obtain the Latest Service Pack for Internet Explorer 6
For additional information about how to obtain the latest service pack for Internet Explorer 5.5, click the following article number to view the article in the Microsoft Knowledge Base:
276369 How to Obtain the Latest Service Pack for Internet Explorer 5.5
For additional information about how to obtain Internet Explorer 5.01 SP3, click the following article number to view the article in the Microsoft Knowledge Base:
267954 How to Obtain the Latest Internet Explorer 5.01 Service Pack
Restart Requirements
For the Internet Explorer 6 and Internet Explorer 6 SP1 packages, you must restart your computer to complete the installation of this update. For all other versions of this package, you must restart your computer and then log on as an administrator to complete the installation of this update.
Previous Update Status
This update supercedes the MS03-015: April, 2003, Cumulative Patch for Internet Explorer update (813489).
Setup Switches
The Windows Server 2003 (this includes Windows XP 64-Bit Edition Version 2003) versions of this patch support the following Setup switches:
- /? Show the list of installation switches.
- /u Use Unattended mode.
- /f Force other programs to quit when the computer shuts down.
- /n Do not back up files for removal.
- /o Overwrite OEM files without prompting.
- /z Do not restart when installation is complete.
- /q Use Quiet mode (no user interaction).
- /l List installed hotfixes.
- /x Extract the files without running Setup.
For example, to install the patch without any user intervention, use the following command:
windowsserver2003-kb818529-x86-enu.exe /u /q
To install the patch without forcing the computer to restart, use the following command:
windowsserver2003-kb818529-x86-enu.exe /z
Note You can combine these switches in one command.
For information about how to deploy this patch by using Software Update Services, visit the following Microsoft Web site:
The other update packages for this patch support the following switches:
- /q Specifies Quiet mode or suppresses messages when the files are being extracted.
- /q:u Specifies User-Quiet mode, which presents some dialog boxes to the user.
- /q:a Specifies Administrator-Quiet mode, which does not present any dialog boxes to the user.
- /t:
path
Specifies the target folder for extracting files. - /c Extracts the files without installing them. If /t:
path
is not specified, you are prompted for a target folder. - /c:
path
Specifies the path and name of the Setup .inf file or the .exe file. - /r:n Never restarts the computer after installation.
- /r:i Prompts the user to restart the computer if a restart is required, except when used with the /q:a switch.
- /r:a Always restarts the computer after installation.
- /r:s Restarts the computer after installation without prompting the user.
- /n:v No version checking. Use this switch with caution to install the update on any version of Internet Explorer.
For example, to install the update without any user intervention and not to force the computer to restart, use the following command:
q818529.exe /q:a /r:n
File Information
The English version of this fix has the file attributes (or later) that are listed in the following tables. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
The following files are installed in the %Windir%\System folder in Windows 98 Second Edition and Windows Millennium Edition. They are installed in the %Windir%\System32 folder in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003.
Internet Explorer 6 (32-Bit) for Windows Server 2003 and Windows XP 64-Bit Edition Version 2003
Date Time Version Size File name ------------------------------------------------------- 28-May-2003 01:46 6.0.3790.41 1,361,408 Shdocvw.dll 28-May-2003 01:46 6.0.3790.9 498,176 Urlmon.dll
Internet Explorer 6 (64-Bit) for Windows Server 2003 64-Bit Versions and Windows XP 64-Bit Edition Version 2003
Date Time Version Size File name Platform ------------------------------------------------------------------ 28-May-2003 01:41 6.0.3790.41 3,359,744 Shdocvw.dll IA64 28-May-2003 01:41 6.0.3790.9 1,271,296 Urlmon.dll IA64 28-May-2003 01:54 6.0.3790.41 1,361,408 Wshdocvw.dll x86 28-May-2003 01:54 6.0.3790.9 498,176 Wurlmon.dll x86
Internet Explorer 6 SP1 (32-Bit) for Windows XP SP1, Windows XP, Windows 2000 SP3, Windows 2000 SP2, Windows NT 4.0 SP6a, Windows Millennium Edition, and Windows 98 Second Edition
Date Time Version Size File name --------------------------------------------------------- 24-Feb-2003 18:31 6.0.2800.1170 2,787,840 Mshtml.dll 23-May-2003 17:15 6.0.2800.1203 1,338,880 Shdocvw.dll 14-Apr-2003 13:25 6.0.2800.1188 483,840 Urlmon.dll
Internet Explorer 6 SP1 (64-Bit) for Windows XP 64-Bit Edition Version 2002
Date Time Version Size File name Platform ------------------------------------------------------------------- 24-Feb-2003 17:50 6.0.2800.1170 9,075,200 Mshtml.dll IA64 23-May-2003 16:39 6.0.2800.1203 3,648,000 Shdocvw.dll IA64 14-Apr-2003 21:02 6.0.2800.1188 1,412,096 Urlmon.dll IA64
Internet Explorer 6 (32-Bit) for Windows XP
Date Time Version Size File name --------------------------------------------------------- 25-Feb-2003 22:19 6.0.2726.2500 2,762,240 Mshtml.dll 23-May-2003 02:01 6.0.2722.900 34,304 Pngfilt.dll 05-Mar-2002 00:09 6.0.2715.400 548,864 Shdoclc.dll 22-May-2003 22:49 6.0.2729.2200 1,336,320 Shdocvw.dll 23-May-2003 02:01 6.0.2715.400 109,568 Url.dll 14-Apr-2003 14:02 6.0.2728.1400 481,280 Urlmon.dll 06-Jun-2002 17:38 6.0.2718.400 583,168 Wininet.dll
Internet Explorer 5.5 SP2 for Windows 2000 SP3, Windows 2000 SP2, Windows NT 4.0 SP6a, Windows Millennium Edition, and Windows 98 Second Edition
Date Time Version Size File name ---------------------------------------------------------- 25-Feb-2003 22:04 5.50.4926.2500 2,759,440 Mshtml.dll 17-Oct-2002 00:01 5.50.4922.900 48,912 Pngfilt.dll 22-May-2003 23:09 5.50.4929.2200 1,149,200 Shdocvw.dll 05-Mar-2002 01:53 5.50.4915.500 84,240 Url.dll 14-Apr-2003 15:10 5.50.4928.1400 451,344 Urlmon.dll 06-Jun-2002 21:27 5.50.4918.600 481,552 Wininet.dll
Internet Explorer 5.01 SP3 for Windows 2000 SP3
Date Time Version Size File name --------------------------------------------------------- 28-Mar-2003 22:20 5.0.3516.2800 2,357,008 Mshtml.dll 14-Oct-2002 15:28 5.0.3510.1100 48,912 Pngfilt.dll 23-May-2003 17:47 5.0.3518.2300 1,099,536 Shdocvw.dll 05-Mar-2002 01:53 5.50.4915.500 84,240 Url.dll 14-Apr-2003 14:25 5.0.3517.1400 451,856 Urlmon.dll 07-Jun-2002 23:56 5.0.3506.1000 461,584 Wininet.dll
Note Because of file dependencies and Setup or removal requirements, these updates may also contain additional files.
Removal Information
To remove this update, use the Add or Remove Programs tool (or the Add/Remove Programs tool) in Control Panel. Click Internet Explorer Q818529, and then click Change/Remove (or click Add/Remove ).
On Windows Server 2003 and Windows XP 64-Bit Edition Version 2003, system administrators can use the Spunist.exe utility to remove this patch. The Spuninst.exe program file is located in the %Windir%\$NTUninstallKB818529$\Spuninst folder. This utility supports the following Setup switches:
- /? Show the list of installation switches.
- /u Use Unattended mode.
- /f Force other programs to quit when the computer shuts down.
- /z Do not restart when installation is complete.
- /q Use Quiet mode (no user interaction).
On all other versions of Windows, system administrators can use the Ieuninst.exe utility to remove this update. The Ieuninst.exe program file is located in the %Windir% folder and supports the following command-line switches:
- /? Show the list of supported switches.
- /z Do not restart when installation is complete.
- /q Use Quiet mode (no user interaction).
For example, to remove this update quietly, use the following command:
c:\windows\ieuninst /q c:\windows\inf\q818529.inf
Note This command line assumes that Windows is installed in the C:\Windows folder.
Known Issues
- On a Windows 2000-based or on a Windows XP-based computer, you can install the 813489 critical update after you install the 818529 critical update. If you do this, the updated files in the 818529 critical update are replaced by the older files in the 813489 critical update. To resolve this issue, reinstall the 818529 critical update.
- You can install the Internet Explorer 5.5 SP2 version of the 818529 critical update on a Windows 2000 SP3-based computer that is running Internet Explorer 5.01 SP3. To resolve this issue, remove the Internet Explorer 5.5 SP2 version of the 818529 critical update, and then install the Internet Explorer 5.01 SP3 version of the 818529 critical update. Administrators can use the Ieuninst.exe tool to remove the Internet Explorer 5.5 SP2 update as described in the "Removal Information" section of this article. For example, to remove the update quietly, use the following command:
c:\windows\ieuninst /q c:\windows\inf\q818529.inf
- After you remove the 818529 critical update, you cannot remove previous cumulative updates for Internet Explorer (such as the 813489 critical update). This behavior is by design. Removing is supported only for the last cumulative update that you installed.
- For additional information about known issues that may occur after you install this update, click the following article number to view the article in the Microsoft Knowledge Base:
325192 Issues After You Install Updates to Internet Explorer or Windows
Keywords: kbhotfixserver kbqfe kbinfo KB818529