VML Patch Is Out - Unapply The Mitigations

The VML patch is out. Microsoft just released MS06-055 out of band.

If you have applied the work-arounds you need to know a few things first though:

This update does not fix the DirectAnimation Path issue. It only fixes the VML vulnerability.

If you have applied the Access Control List (ACL) change mitigation you need to unapply it before you can install the patch. To do that you need to either use the GUI to remove the deny ACL Entry (ACE) for Everyone, or implement a command line way to remove that ACE. The enableVML.inf security template I posted with the first post I wrote on this topic will do it. You can use that in a GPO, or you can use it on the command line with this command
secedit /configure /db foo.sdb /cfg enableVML.inf /log foo.log

Please note that the command given in the security bulletin to remove the ACE does not currently work. It is not structured correctly. To remove the mitigation with a cacls command you can use
cacls %CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll /e /r Everyone

This is what I do in the startup script I posted. However, this command will remove all permissions for Everyone. Ordinarily this would not be a problem, but if you have a system with non-standard ACLs it could cause a problem. This is documented in my other post today.

Finally, if you use the unregistration work-around, as I did in the startup script, you must re-register the DLL to restore functionality. This can be done using the startup script by using the "enable" switch instead of the "disable" switch. Note that unless you modify the script though it will leave you vulnerable to the DirectAnimation Path issue, which is mitigated using the same script.