SYMPTOMS
After you apply the fixes that are in Microsoft Security
Bulletin MS04-004 and Microsoft Knowledge Base article 832414, the Microsoft
XML Parser (MSXML) user credentials may be cached. Then, MSXML may use user
sessions incorrectly within a single Microsoft Internet Explorer process. For
example, a user may successfully connect with the following function call:
xmlhttp.open("GET", "http://www.myserver.com/myfiles", false, "correctusername", "correctpassword")
Then, the user may notice that the following call also succeeds when it
is used subsequently in the same process:
xmlhttp.open("GET", "http://www.www.myserver.com.com/myfiles", false, "incorrectusername", "incorrectpassword")
The second call should fail because the credentials are incorrect.
However, the call succeeds because of changes in the default behavior of
Internet Explorer after you apply the MS04-004 security
update.
back to the
topRESOLUTION
Hotfix information
To resolve this behavior, update your version of MSXML. To do this, visit one of the following Microsoft Web sites.
Note If you have MSXML 3.0 installed, you must install a service pack.MSXML 2.6 package for Microsoft Windows 2000, Windows XP, and Windows Server 2003 English version:
Arabic version:
Chinese (China) version:
Chinese (Taiwan) version:
Czech version:
Danish version:
Dutch version:
Finnish version:
French version:
German version:
Greek version:
Hebrew version:
Hungarian version:
Italian version:
Japanese version:
Korean version:
Norwegian version:
Polish version:
Portuguese (Brazil) version:
Portuguese (Portugal version):
Russian version:
Spanish version:
Swedish version:
MSXML 2.6 Package for Windows 98 and Windows
Millennium EditionAll language versions:
MSXML
3.0If you are running MSXML 3.0, install the latest service pack. To
do this, visit the following Microsoft Web site:
MSXML 4.0 Service Pack 2 (SP2) Package for Windows 2000, Windows XP, and Windows Server 2003English version:
Chinese (China) version:
Chinese (Taiwan) version:
French version:
German version:
Italian version:
Japanese version:
Korean version:
Spanish version:
MSXML 4.0 SP2 Package for Windows 98 and Windows
Millennium EditionAll language versions:
back to the topPrerequisites
To apply this hotfix, you must have the following hotfixes or
service packs installed:
- Either MSXML 2.6 or MSXML 4.0 SP2.
Note If you do not currently have MSXML 2.6 or MSXML 4.0 SP2 installed
on your system, you do not have to apply this hotfix. - MS04-038 - Cumulative Security Update for Internet
Explorer. This hotfix relies on Internet Explorer updates that are made in the
MS04-038 security update. If you apply this hotfix without applying Internet
Explorer security update MS04-038, you may experience the behavior that is
described in the following Knowledge Base article:
832414 XMLHTTP call fails for URLs with embedded user credentials
For additional information about
security update MS04-038, click the following article number to view the
article in the Microsoft Knowledge Base: 834707
MS04-038: Cumulative Security Update for Internet Explorer
back to the topRestart information
If MSXML 2.6, MSXML 3.0, or MSXML 4 is being used when you apply
this hotfix, you may have to restart your computer after you apply the hotfix
or upgrade to MSXML 3.0 Service Pack 5 (SP5).
back to the topHotfix file information
This hotfix contains only those files that are required to correct
the issues that this article lists. This hotfix may not contain all the files
that you must have to fully update a product to the latest
build.
The English version of this hotfix has the file
attributes (or later file attributes) that are listed in the following table.
The dates and times for these files are listed in coordinated universal time
(UTC). When you view the file information, it is converted to local time. To
find the difference between UTC and local time, use the
Time
Zone tab in the Date and Time tool in Control Panel.
MSXML 2.6
Date Time Version Size File name
----------------------------------------------------
15-Oct-2004 01:35 8.30.9531.0 701,440 Msxml2.dll
MSXML 4.0
Date Time Version Size File name
------------------------------------------------------
03-Aug-2004 17:20 4.20.9828.0 1,234,432 Msxml4.dll
Note Because of file dependencies, the most recent hotfix that
contains these files may also contain additional files.
back to the
top