Updated Merge Modules for MS08-070 Security Bulletin
I am using InstallShield 12, but I imagine this would affect lots of versions of InstallShield.
Our product includes several Merge Modules (e.g. comct232.msm, msdatgrd.msm, mscomct2.msm, msflxgrd.msm, mswinsck.mwm, and others) which originally came from InstallShield. Earlier this month, Microsoft released a security update regarding vulnerabilities in many VB6 Runtime files, including the OCX files that are included in these merge modules.
I can get the updated, secure OCX files by manually installing the Microsoft hotfix on a VB6 machine, but this does not provide the updated Merge Modules. Ideally, I would like to have new Merge Modules to put into the C:\Program Files\Common Files\Merge Modules\ folder on my InstallShield system so that future customers will not be getting the vulnerable version of these OCX files, but there does not appear to be any place to get these MSM files.
Any suggestions out there?
Is this the update you are talking about...
It seems to list some locations for getting the updated msms.
Yes, that is the update, but I was not able to get the msm files I need based on the info in that article.
The problem is that the merge modules listed in the Microsoft article are either the merge modules I do not require (such as Msmask32_x86.msm), or they are only shown as updates for Visual FoxPro which I am not using. I have tried to grab the FoxPro update anyways to see if I could extract the merge modules I am interested in, but that doesn't seem to work for me, plus one of the original InstallShield merge modules (I don't recall which one because I'm not at the office right now) is not in the FoxPro list either.
I'm still stuck and wishing the either Microsoft or InstallShield would publish updated MSM files for all the affected files.
So is this the complete list of ones you need...
comct232.msm, msdatgrd.msm, mscomct2.msm, msflxgrd.msm, mswinsck.msm?
I can see if I can get some of my contacts at Microsoft to get us them.
Last edited by Mike Marino; 12-26-2008 at 12:00 PM.
If you could pull that off with Microsoft, Mike, that would be a huge help.
There are actually three others that I'm pretty sure InstallShield also includes which are affected by this update. I don't recall if I definitely need these three myself (I'm still out of the office for a while), but if you could look into them at the same time, I'm sure somebody must be using them. They are mschrt20, mshflxgd, and msmask32.
The complete list would be:
comct232.msm, msdatgrd.msm, mscomct2.msm, msflxgrd.msm, mswinsck.msm, mschrt20.msm, mshflxgd.msm, msmask32.msm
Thanks for looking into this Mike.