Help! VS.NET 2003, MSO.DLL, and the JPEG exploit

I ran a scanner released by SANS today and it revealed a "vulnerable" (to
the GDI+ jpeg exploit) version of MSO.DLL:

C:\Program Files\Common Files\Microsoft Shared\Office10\MSO.DLL
Version: 10.0.3501.0 <-- Vulnerable version

Well since I don't have office 10, but had previously installed a trial
version of FrontPage 2000 (is that office 10?) I assumed I could get rid of
the file.

Bad move. It broke VS.NET which promptly tried to re-install itself. So I
put the file back and VS was fine. I have tried removing the file and
registry references to it, but then VS wouldn't start: Unspecified Error. So
I ran the install and selected repair/reinstall. When it was done, VS ran
fine but the entire Office10 folder (including the vulnerable file) was
back. Neither the update for VS.Net 2003 nor Framework 1.1 (to address the
JPEG exploit) replaces this file, yet VS.NET won't run without it.  I can't
load any update or service pack that does replace the file because I don't
have a qualifying product. I can't just get the updated file at least as far
as I've tried. I'm going NUTS!

Any ideas? Does VS.NET actually USE MSO.DLL? From what I understand, it's
part of later versions of MS Office. Whassup?
--
Jim

> Any ideas? Does VS.NET actually USE MSO.DLL? From what I understand, it's
> part of later versions of MS Office. Whassup?
Visual Studio .NET 2003 uses MSO.DLL for the "office XP" ui functionality.

"Jonathan Wilson" <jonwil@tpgi.com.au> wrote in message
news:ue1PcjooEHA.596@TK2MSFTNGP11.phx.gbl... 
it's 
> Visual Studio .NET 2003 uses MSO.DLL for the "office XP" ui functionality.

Is there any way to get it updated if you don't have Office XP?
--
Jim
"Remember, an amateur built the Ark; professionals built the Titanic."

MSO.DLL has been part of Office as far back as Office 97 at least, maybe =
95, but usually with a number after it...

MSO7ENU.DLL for Office 95 and 97, MSO9.DLL for Office 2000.

Office component versoning after Word 6...

Office 95 is v7, Office 97 v8, Office 2000 v9, Office XP v10, =
Office 2003 v11.

Chris



"Jim Nugent" <njim2k-nntp@yahoo.com> wrote in message =
news:OIXDGxnoEHA.1588@TK2MSFTNGP09.phx.gbl...
> I ran a scanner released by SANS today and it revealed a "vulnerable" =
(to
> the GDI+ jpeg exploit) version of MSO.DLL:
>=20
> C:\Program Files\Common Files\Microsoft Shared\Office10\MSO.DLL
>    Version: 10.0.3501.0 <-- Vulnerable version
>=20
> Well since I don't have office 10, but had previously installed a =
trial
> version of FrontPage 2000 (is that office 10?) I assumed I could get =
rid of
> the file.
>=20
> Bad move. It broke VS.NET which promptly tried to re-install itself. =
So I
> put the file back and VS was fine. I have tried removing the file and
> registry references to it, but then VS wouldn't start: Unspecified =
Error. So
> I ran the install and selected repair/reinstall. When it was done, VS =
ran
> fine but the entire Office10 folder (including the vulnerable file) =
was
> back. Neither the update for VS.Net 2003 nor Framework 1.1 (to address =
the
> JPEG exploit) replaces this file, yet VS.NET won't run without it.  I =
can't
> load any update or service pack that does replace the file because I =
don't
> have a qualifying product. I can't just get the updated file at least =
as far
> as I've tried. I'm going NUTS!
>=20
> Any ideas? Does VS.NET actually USE MSO.DLL? From what I understand, =
it's
> part of later versions of MS Office. Whassup?