5 replies to this topic

[TechDud]

Within VB60SP6-KB2641426-x86-ENU.msi you will find "mscomctl.cab" containing an inf file & the ActiveX component.
If it helps, great; if not, c'est la vie!

[ViroMan]

At first I was like... "whats this guy on about?", then it hit me. Ya I know there is newer stuff out there for the older apup but, it won't affect apup in the least to update and it, and it may even break it, if we update them all. Point is... It is not really worth the effort to do so and put up a new zip with new components but, same old apup. I only did that for curl because it was soo old that it did not support nearly as many things as the newer one did and curl is fairly useful for other things as well.

[TechDud]

I understand, forgive me for my previous lack of clarity. At least you have a link handy should it ever be deemed necessary for APUP.

Actually, this is supposed to plug a "Vulnerability in Windows Common Controls" that "Could Allow Remote Code Execution" Is it likely that AutoPatcher is immune from this issue?

I note that the installer demands that VisualBasic is installed as a prerequisite. Extracting the installer yields a variety of .cab files including Inf scripts. These facts are likely not helpful to AP, though. This seems to replace VB60SP6-KB957924-v2-x86-ENU.msi

[ViroMan]

AP is totally immune from that since it does not go online. APUP v1 does use it but, it does not directly go online. All the downloading for APUP v1 is done through CURL an external application so, even then it is not possible to be exploited through this bug. Also as you say since Visual Basic is needed for the install, im pretty sure it would also be non distributable.

We DO appreciate you looking out for us though. keep it up.

Edited by ViroMan, 17 April 2012 - 04:37 AM.

[TechDud]

Actually, i was thinking of a script that would only update the several main ActiveX components. I remember the kerfuffel years ago that prompted the linking, and understand that this idea would be a non-starter for your project. Kudos to the AP group for doing what was necessary to ensure the future of this project.

VB6 is to be officially supported on Windows8 (other than ARM) so it will still be with us for a few years. http://msdn.microsof...studio/ms788708

Quote

"Supported Runtime Files – Extended Files to Distribute with your application: extended list of key controls, libraries, and tools that are installed from the IDE media or from Microsoft.com to the developer machine. Typically the VB6 IDE installed these controls to the developer machine by default. The developer still needs to redistribute these files with the application. The supported version of the files is available online on the Microsoft Download Center (http://go.microsoft..../?LinkID=142927)."

There are mscomctl.ocx updates for Office 2003 through Office 2010 SP1 specifically for those products. I'll post links in the appropriate group if they do not currently exist.

[ViroMan]

well we probably wouldn't write a script just for that. We would included it in all the OS scripts that should have it since its an actual update to parts of the OS.