Jump to content

MS to release patch for IE bug including Windows XP


the xt guy

Recommended Posts

[...] (observe that the current one is for IE 6-11, not XP!) [...]

Technically, no IE8 isn't XP, but what I meant is IE8 supports XP, so it's like extending End of Support for XP. :yes:

True enough! And, since IE8 is supported both on Win Server 2003 (EoS: Jul 14, 2015) and on Win Embedded POSReady 2009 (EoS: Apr 09, 2019), then all IE8 components and patches go on up to at least Apr 2019. :D

I like the way you talk, but Mr Nadella doesn't. LOL

Link to comment
Share on other sites


Mr. Nadella's got his head in the clouds... he doesn't care any about a handful of die-hards.

Of course he doesn't. But to be fair, it was a classy and respectable move to issue IE6 to IE8 this patch.

Link to comment
Share on other sites

In general you're right. But for x86 IE7 and x86 IE8 the files are the exact same version, although they clearly are different compilations, but I bet the mshtml.dll intended for 2003 works alright in XP, and vice versa...

 

It does. Just tested it. WU and everything.

By extracting IE8-WindowsServer2003-KB2964358-x86-ENU.exe one gets one mshtml.dll file I'll henceforward call mshtml_2k3.dll, which PE Timestamp is 0x5360C507 or Wed Apr 30, 2014 09:40:23 UTC. It has Image Base = 3EC80000, PE Checksum = 005BF3E7, MD-5 = 2652A0D1140422D9DA651A446240499D and CRC-32 = B346E2D0. OTOH, by extracting IE8-WindowsXP-KB2964358-x86-ENU.exe one gets another mshtml.dll file I'll call mshtml_xp.dll, which PE Timestamp is 0x5360B08D or Wed Apr 30, 2014 08:13:01 UTC. It has Image Base = 3C510000, PE Checksum = 005BF2F9, MD-5 = 3DB2624CCB1663BF6D62311B2B9E7B55 and CRC-32 = 05F2D23B. Both mshtml.dlls have file version = 8.00.6001.23588 (longhorn_ie8_ldr_escrow.140429-1230) and they are 6,022,144 bytes long. By opening them simultaneously with Beyond Compare 3, one finds out both mshtml.dlls are 96,8% equal, differing in just 195226 bytes, which, very visibly, appear grouped as matched word-pairs dispersed throughout those files...

Now, after rebasing to 3C510000 mshtml_2k3.dll from its original image base, by using the command:

REBASE -v -b 0x3C510000 <drive>:\<path>\mshtml_2k3.dll

and then comparing the resulting mshtml_2k3_rb.dll to mshtml_xp.dll, one finds out that they differ in just 6 bytes, of which 3 are part of the PE Timestamp and the other 3, of the PE Checksum. And if one changes the PE Timestamp by hand with a hexeditor to be the same as that of mshtml_xp.dll, and then recalculates the PE Checksum, both mshtml.dlls become identical!

Therefore, it must be concluded that mshtml_2k3.dll and mshtml_xp.dll are nothing more than two instances of the same executable, differing just in the image base (and its associated relocation address placeholders) and the PE Timestamp (and the consequent PE Checksum, of course!), which is to be expected from two different compilations/linkings of the exact same sources. It's no wonder they can be interchanged: they are funcional equivalents for all relevant purposes.

Obs: the MS REBASE.EXE used in this experiment is 29184 bytes long and has file version = 6.0.4006.0 (Lab01_N.030209-2000), MD-5 = 57B8A0E5863AA2F138DE8B55DCEC3CA2 and CRC-32 = 04999251. It can be found inside PSDK-SDK_Core_BIN-x86.0.cab, which is part of the MS Svr2003SP1 PSDK. After downloading, rename .img to .iso, and extract as usual.

Link to comment
Share on other sites

They had to issue an IE6-8 patch as they still support a varied number of operating systems that shiped with those versions. If the case that was there was no XP specific update, there would be nothing really stopping anybody from applying those patches on XP unofficially.

Like others had already said. we have POS version of XP supported to 2019, we have windows 2003 32bit and vista 32bit and almost certainly besides the kernel differences a majority of the code those operating systems were built with will run on XP.

So, yeah, like we have been saying all along. IF there was no XP patch, I can guarantee within a week we would have an unofficial one.

Link to comment
Share on other sites

Microsoft Explains Logic Behind Patching Windows XP After Retirement

 

“We made this exception based on the proximity to the end of support for Windows XP. The reality is there have been a very small number of attacks based on this particular vulnerability and concerns were, frankly, overblown. Unfortunately this is a sign of the times and this is not to say we don’t take these reports seriously. We absolutely do.”

 

--JorgeA

Link to comment
Share on other sites

 

So anyone want to bet on what the next excuse is going to be?  Or will people start to realize that MS has to release patches for XP since they still suport it.  They just are only supporting VLK professional versions of custumers with contracts and POS Versions of XP that do not require the same contracts..  As well as 2003 server 32bit that may, as well, 've borowed almost all of its IT technology from XP and 2000, except maybe a few minor things.

Link to comment
Share on other sites

I don't get what all the surprise is about, I mentioned a while ago that Microsoft was offering companies extended support at a very steep cost. More baffling, they where actually paying part of the cost of consultants to come in from 3rd party companies (1st hand knowledge FYI) to setup migration infrastructure. M$ are very keen to see the death of XP

Link to comment
Share on other sites

Microsoft Security Bulletin Advance Notification for May 2014 released. 
https://technet.microsoft.com/library/security/ms14-may
 
Three patches for Windows Server 2003 including what looks like yet another Culmative Security Update for Internet Explorer.  :ph34r:
It's only rated Moderate as opposed to Critical for Vista, Windows 7, Windows 8 and Windows 8.1.
I presume because server systems ship with Enhanced Protected Mode turned on.

Link to comment
Share on other sites

Well, Bulletin 1 in the IE7 (is there anyone actually still using IE7 in the wild?) and IE8 versions should be immediately usable, perhaps requiring a relaxing of the .INF  "Applies To"  conditions, perhaps even directly. The IE6 version has traditionally had components with different version numbers, so some testing is required, but probably should work, too.

I'm betting Bulletin 5 (the .NET one) may be directly applicable, too, perhaps requiring, likewise, some previous callisthenics... :)

As for Bulletin 6, we'll only know, when whe know what does it contain. For now, nothing can be said.

All other bulletins do not apply, which is good! :yes:

Thanks for the heads up, -X- !  :thumbup

Link to comment
Share on other sites

Well, Bulletin 1 in the IE7 (is there anyone actually still using IE7 in the wild?)

 

<raising hand> I have two lightly used Vista installations where IE7 rules. One of them (a laptop) had gone as far as IE8, but the HDD died (the computer was so secondary that it wasn't worth having a backup) and when I put in a new HDD and reinstalled from the recovery disks, I left IE7 untouched.

 

I actually prefer the look of IE7 even to that of IE8. In IE8 you can already see how Microsoft was messing with the interface, in this case getting rid of some of the visual contrast or 3D/convex effects up in the toolbar region. With IE9 this region became completely flat and featureless, and the horizontal borders between levels of toolbars (I'm not sure of the nomenclature here) were removed altogether.

 

--JorgeA

Edited by JorgeA
Link to comment
Share on other sites

:blushing:  Errr...

 

Well...

 

:huh:  Oh, yes! But that's on Vista!!!

 

So, yes... I mean... no: what I had on mind was something like:

 

"is there anyone actually still using IE7 on XP in the wild?"    :angel 

 

the reason being that anyone who'll take the trouble to update IE on XP ought to do it directly to IE8, IMO.

 

But, then again, real life is more complicated than that, anyway...  :yes:

 

 

 

 

Link to comment
Share on other sites

I ran IE6 up until April 2013. :crazy:  I dislike the amount of real estate IE8 takes up. I only upgraded because they completely broke microsoft.com via clicking the more details link in Windows Update. I only use IE for WU. 

 

UDC changelog...

UDCChangelog.png

Edited by -X-
Link to comment
Share on other sites

I use IE8 for WU (MU actually) and for some sites requiring ActiveX.

And as a plain-vanilla baseline, when in doubt (I also have Opera 12.17 for this purpose)...

But I use FF 24 esr (with NoScript, RefControl and PlainOldFavorites) as my main browser.

 

But, in any case, my main point was: the files from the fixes for IE7 and for IE8 ought to be usable directly.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...