VB6 SP6 Security Update Dec 9, 2008

[dee-u]

May I ask ? What does the WinShock control do ?

I hope you will not be shocked to know that it is Winsock and not WinShock.

[ThEiMp]

Winsock is a networking, IP address handling activex control. That is written to be used in Forms, that require such things to happen in them.

[Black Zero]

I hope you will not be shocked to know that it is Winsock and not WinShock.

rofl. http://www.vbforums.com/images/smilies/biggrin.gif

On topic: I've never have any issue with my normal SP6, so I won't be updating to this patch for a little while longer. Plus, now I'm learning .NET>

[ThEiMp]

Is the same factor of upgrading in VB.NET 2005? I was working with VB.NET, but couldn't take the whole thing. So I then went back to VB6 Pro, for the sake of it all.

[dee-u]

Is the same factor of upgrading in VB.NET 2005? I was working with VB.NET, but couldn't take the whole thing. So I then went back to VB6 Pro, for the sake of it all.

You should not use winsock in .Net anymore, there are the socket classes that replaces the winsock.

[dilettante]

Rumor from a VB MVP:

I wouldn't hold your breath, but the response I got was my request is in the channels and they are aware of other issues and a fix is on the way. I don't know much more than that yet though.

[7edm]

I think it's proper to bump this threed and add the information that KB957924 has been updated since the above post

Article ID: 957924 - Last Review: May 20, 2009 - Revision: 3.3

and that a new Visual Basic 6.0 Service Pack 6 Cumulative Update

File Name: VB60SP6-KB957924-v2-x86-ENU.msi
Version: 6.0
Knowledge Base (KB) Articles: KB957924
Date Published: 5/4/2009
Language: English
Download Size: 9.8 MB

is available for download.

I would also like to add that I personally have downloaded and installed this update on Win7 64-bits without any issues noted so far (about a week).

I don't know if it also solve the above issue, so no confirmation on that so far.

[ThEiMp]

So where is the link, that goes with it. Leave it up on the thread...

[7edm]

So where is the link, that goes with it. Leave it up on the thread...

Well I only linked to the KB article as it has the link and it might be a good idea to read the article... but edited my post to include the download link as well for those who want to go direct on to it.

[FireXtol]

Or just use the link in my sig(the last one!(of the first list)).. and get taken directly to the page with all of these downloads on it(and more!).

TIP: None of the "Essential" downloads are essential in any sense of the word. The "Additional Downloads" are the essential downloads for VB6 programmers.

[dilettante]

The 5/4/2009 "update" corrected a few of the most minor problems, but the serious flaws are still there.

I strongly suggest you do not install this on any production machine and NEVER INSTALL THIS ON A DEVELOPMENT MACHINE.

It is viral in the sense that a developer may package and distribute these flawed components and many users might inadvertantly install them, breaking these component libraries for all non-isolated applications on those machines. Some of the controls I know to be broken in this "security rollup" are the Winsock control (which will return bad values from IP address properties) and the MSChart control (which indexes a number of internal object collections "off by one" producing mangled results and invalid index exceptions).

Once again, note that this patch cannot be uninstalled once you have installed it!

[ThEiMp]

Didn't they beta test the program, in the first place???
I mean that for thirteen years, of my programming professional life. I always sent off my programs to be beta tested. Even, then: They came back with errors, sytax errors, etc...

[si_the_geek]

Didn't they beta test the program, in the first place???

Of course they did, but with something of that magnitude (and absolutely enormous existing user code base) it is easy to miss something during testing - or in this case, a few things.

I mean that for thirteen years, of my programming professional life. I always sent off my programs to be beta tested. Even, then: They came back with errors, sytax errors, etc...

Hang on... you have been a professional programmer for more than a couple of days?

Why on earth do you still consistently write code like a beginner, such as this from two days ago?

Just the Text1_Change event (6 lines of code) contains 1 obvious mistake that makes it behave incorrectly, obscenely foolish use of On Error Resume Next, blatantly superfluous code, and complete lack of object naming. There is another clear issue too, but it is a bit beyond beginner level.

While Microsoft have apparently made mistakes in this package (I'm not risking checking it myself!) and that is clearly very disappointing, it is extremely naive to pretend that you would have done any part of it better.

[Dragokas]

Is someone tested update:

1/8/2016
Microsoft Visual Basic 6.0 Service Pack 6 Security Rollup Update
https://www.microsoft.com/en-us/down....aspx?id=50722
VB60SP6-KB3096896-x86-ENU.msi - 9.9 MB
?

It replace mscomctl by version 5-Nov-2015 (list of files).

Is it stable, no new bugs?

EDIT.
I just read a comment of dilettante in thread:

This set of patches cannot be uninstalled. It contains lots of bugs including quite a few "off by one" coding errors that cause some of the controls patched to become unusable. In some cases internal collections are broken (numeric index vaues are off by 1), in others data gets truncated (Winsock control can return truncated-by-one-char values, e.g. LocalIP).

Is some of these bugs (committed in 2012 KB2708437) belongs to mscomctl also?

[dilettante]

A programmer I used to collaborate with had accumulated a suite of test programs.

These used several of the controls with known issues and tested instances of them to see if different "discovered" problems were present or fixed in versions of the ill-fated "Security Rollup Fix" releases and re-releases. He tested using a VM for each round of testing because of the problems with being unable to uninstall a Rollup release.

After a while he had switched to extracting the OCXs from each Rollup package, and then used SxS Reg-Free COM manifests with his test programs. This meant he no longer had to install the Rollup attempt packages to test the OCXs inside them. It also meant he didn't need to keep creating fresh VMs because he was never installing Rollup packages.

The problem is, until he knew a bug existed he couldn't devise a test for it. So we never really knew all of the bugs, and worse yet some re-releases of these OCXs fixed a bug and later ones brought it back or added new bugs.


Sadly for us, he never created a table of the known and suspected bugs and their state in different Rollup re-release packages (known only by MSKB numbers, package dates, and the compiled OCX timestamps since Microsoft doesn't give them reliable version numbers we can look for). This programmer has also moved on from Windows programming and only does Android and iOS programming now.

Maybe somebody else has been tracking these and testing them?


At the download page for this re-release of the Rollup:

This package updates the Microsoft Windows Common Controls, mscomctl.ocx and comctl32.ocx, found in Microsoft Visual Basic 6.0 Service Pack 6. This package will not install these Common Controls if the Visual Basic 6.0 IDE is not installed. This package cannot be uninstalled. Please refer to the security bulletin for additional details.

The Visual Basic 6.0 IDE is no longer supported as of April 8, 2008, however, the Visual Basic team is committed to “It Just Works” compatibility for Visual Basic 6.0 applications

These Rollup packages suggest it is really more like "It Works If You're Lucky, Until We Break It Through Ineptitude."

[DEXWERX]

like they did recently with the updated USB portion in windows 10.