You need to manually undo your MS08-078 mitigations

Just as an FYI, for those of you that used Microsoft's recommended mitigations for MS08-078. If you unregistered the MSXML Island object you need to manually re-create the registry entries after you install the patch to restore the functionality. The patch does not re-create the registry entries. Unfortunately, it appears Microsoft removed the actual registry entries from the bulletin and removed the work-around information from the advisory altogether, so unless you created a backup copy, you will need to look at an untouched system to find out what the registry entry was.

Or, you can just copy this into a text file called “WhyDidTheyRemoveTheInformationINeed.reg” and double-click it:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{379E501F-B231-11D1-ADC1-00805FC752D8}]
@="MsxmlIsland"

 [HKEY_CLASSES_ROOT\CLSID\{379E501F-B231-11D1-ADC1-00805FC752D8}\InProcServer32]
"ThreadingModel"="Apartment"
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6d,00,73,00,\
78,00,6d,00,6c,00,33,00,2e,00,64,00,6c,00,6c,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{379E501F-B231-11D1-ADC1-00805FC752D8}\TypeLib]
@="{D63E0CE2-A0A2-11D0-9C02-00C04FC99C8E}"

Published Thu, Dec 18 2008 9:57 AM by jesper
Filed under: , ,

Comments

# craig humphrey said on 18 December, 2008 01:31 PM

Hey Jesper,

must be time you headed back to MS, they're getting sloppy.

BTW missed you at TechEd08 in New Zealand this year, all we had was Steve to entertain/inform us :)

Later'ish

Craig

# gregg keizer said on 18 December, 2008 06:46 PM

NIce catch, Jesper.  Looks like MSFT reads you, or someone catch the omission; they've updated the bulletin to add, among some other things, undo instructions for the workaround.

# PGiesbergen said on 19 December, 2008 12:02 PM

Or just run regsvr32 c:\windows\system32\msxml3.dll