Message-ID: <20040416235847.GYQA15811.tomts20-srv.bellnexxia.net@hidden>
From: technoboy at packetswar.org (Technoboy)
Subject: RE: MS04-011 Break SSL support in IE 6.0.3790.0 with Windows 2003

<http://support.microsoft.com/?kbid=261328>

None of these solutions will resolve the MS04-011 issue with win2003,
Microsoft recommand to reinstall IE6... If your IE is current on security
patches and you download the IE 6 SP1 executable (ie6setup.exe) you will
receive the following error message when trying to install:

"Setup has detected a newer version of internet explorer already installed
on this system."
"Setup cannot continue"

I even gave a try with the following registry hack:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed
Components\{89820200-ECBD-11cf-8B85-00AA005B4383\"IsInstalled"=dword:0000000
1

Edited to...

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed
Components\{89820200-ECBD-11cf-8B85-00AA005B4383\"IsInstalled"=dword:0000000
0

Did a reboot, selected yes when asked to remove the IE settings and i
received another error stating that a 'newer version of internet explorer
6.0 have been detected on this machine'...

>This behavior can occur if the Schannel.dll, Rsabase.dll, or Rsaenh.dll
files are missing, damaged, or of the incorrect version. 

I believe this is specific to Windows ME.

For the moment, I uninstalled the MS04-011 patch, waiting for an 'patch for
the patch' from microsoft... If anyone find a workaround, I would like to
know.

good weekend to all,

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Thor Larholm
Sent: Friday, April 16, 2004 6:34 PM
To: Technoboy; full-disclosure@...ts.netsys.com
Cc: bugtraq@...urityfocus.com; ntbugtraq@...tserv.ntbugtraq.com
Subject: [Full-Disclosure] RE: MS04-011 Break SSL support in IE 6.0.3790.0
with Windows 2003

This is a functionality regression that has been around for some time.
The weird part of the MS04-011 patch is that it only occurs on Windows 2003.


KB261328: Cipher Strength Appears as 0-Bit in Internet Explorer
http://support.microsoft.com/?kbid=261328

SYMPTOMS
In Microsoft Internet Explorer, you may experience the following
behaviors: 
When you click About Internet Explorer on the Help menu, the Cipher Strength
value is 0-bit. 

-and-
You cannot connect to and view Web pages on secure Web sites.

CAUSE
This behavior can occur if the Schannel.dll, Rsabase.dll, or Rsaenh.dll
files are missing, damaged, or of the incorrect version. 



Regards

Thor Larholm
Senior Security Researcher
PivX Solutions
24 Corporate Plaza #180
Newport Beach, CA 92660
http://www.pivx.com
thor@...x.com
Phone: +1 (949) 231-8496
PGP: 0x5A276569
6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569

PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of
Qwik-Fix <http://www.qwik-fix.net> 



-----Original Message-----
From: Technoboy [mailto:technoboy@...ketswar.org]
Sent: Friday, April 16, 2004 11:04 AM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] MS04-011 Break SSL support in IE 6.0.3790.0 with
Windows 2003


Hello everyone,

A warning to all Windows 2003 user, this happened on two machine who had
the exact same software configuration but different hardware.

After installing the latest set of patches from microsoft, I was unable
to access sites using SSL, after some investigation it turned out that
my IE Cipher strength was set to 0bit ... After lot of troubleshooting
and tryout with the different solutions offered by Microsoft I decided
to take a guess and uninstall the MS04-011 patch... Well, the problem
solved itself, the IE Cipher Strength is now at 128 like it was before,
I can now access sites using SSL, windowsupdate, msn, etc

Weird ...

Anyone experienced something similar, or its just me ?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Powered by blists - more mailing lists