MS08-070: Vulnerabilities in Visual Basic 6.0 Runtime Extended Files (ActiveX Controls) could allow remote code execution

How to obtain help and support for this security update

Help installing updates:
Support for Microsoft Update

Security solutions for IT professionals:
TechNet Security Troubleshooting and Support

Help protect your computer that is running Windows from viruses and malware:
Virus Solution and Security Center

Local support according to your country:
International Support

Update removal information

For information about how to remove this update, refer to the individual Knowledge Base Articles that are listed in the "Additional information about this security update" section. The individual articles contain information about whether the updates may be uninstalled by using the Add or Remove Programs item in Control Panel.

Known issues with this security update

You install this security update on a computer that has a third-party software solution installed. The software solution is based on Microsoft Visual Basic for Applications (VBA). The software solution creates an instance of the control directly through Microsoft Office. In this scenario, you may experience either of the following problems:

• You may receive an error message that resembles the following when you try to run a macro:
  
  

  
  Object library invalid or contains references to object definitions that could not be found.
  

  
  
  When this problem occurs, the macro does not run.

• You may receive an error message that resembles the following when you try to add one of the updated controls to an Office Visual Basic for Applications form:
  
  
  

  
  Element not found.
  

  
  
  When this problem occurs, the control is not added to the form.
  
  
  
  

Solutions that do not use the control in VBA are not affected by this problem. Compiled Visual Basic 6.0 solutions are not affected. Web-based solutions are not affected. .NET solutions are not affected. Only VBA-based solutions that create an instance of the control directly through Office are affected.


To resolve this issue, install the cumulative update rollup for the Visual Basic 6.0 Service Pack 6 Runtime Extended Files update. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

957924Description of the cumulative update rollup for the Visual Basic 6.0 Service Pack 6 Runtime Extended Files
If you are using Office Visual Basic for Applications, you may also need to delete the cached versions of the control type libraries. To do this, search your hard drive for ".exd," and delete all the .exd files. The .exd files will be re-created automatically using the new controls the next time that you use VBA.

Additional information about this security update

For more information about this security update and for information about any known issues with specific releases of this software, click the following article numbers to view the articles in the Microsoft Knowledge Base:

• 958369 MS08-070: Description of the security update for Microsoft Visual FoxPro 8.0 Service Pack 1: December 9, 2008
  
  

• 958370 MS08-070: Description of the security update for Microsoft Visual FoxPro 9.0 Service Pack 1: December 9, 2008
  
  

• 958371 MS08-070: Description of the security update for Microsoft Visual FoxPro 9.0 Service Pack 2: December 9, 2008
  
  

• 958392 MS08-070: Description of the security update for the Microsoft Visual Studio .NET 2002 Service Pack 1 development platform: December 9, 2008
  
  

• 958393 MS08-070: Description of the security update for Microsoft Visual Studio .NET 2003 Service Pack 1 development platform: December 9, 2008
  
  

• 926857 MS08-070: Description of the security update for Microsoft Visual Basic 6.0 Service Pack 6 Runtime Extended Files: December 9, 2008
  
  

• 957797 MS08-070: Description of the security update for Office XP: December 9, 2008
  
  

• 949045 MS08-070: Description of the security update for Project 2003: December 9, 2008
  
  

• 949046 MS08-070: Description of the security update for Project 2007: December 9, 2008
  
  

Microsoft Visual FoxPro 8.0 Service Pack 1

Microsoft Visual FoxPro 9.0 Service Pack 1

Microsoft Visual FoxPro 9.0 Service Pack 2

Microsoft Visual Studio .NET 2002 Service Pack 1 development platform

Microsoft Visual Studio .NET 2003 Service Pack 1 development platform

Microsoft Visual Basic 6.0 Service Pack 6 Runtime Extended Files

Microsoft Office XP

Microsoft Office Project 2003

Microsoft Office Project 2007