Microsoft has identified a bug in the recent
MS03-32 Security Update for Internet Explorer security patch when
you apply the patch on a computer that is running Microsoft Windows
XP and has Microsoft ASP.NET 1.0 installed. This patch can be
installed manually or by obtaining recent critical updates from the
Windows Update Web site.
After you install the patch, you
receive the following error message when any request is made to
ASP.NET:
Server Application Unavailable
This bug
affects only computers that are running ASP.NET 1.0 on Windows XP.
It does not affect computers that are running Microsoft Windows 2000
or Microsoft Windows Server 2003. This bug also does not affect
computers that are running Windows XP and have ASP.NET 1.1
installed.
The following table lists the operating systems
and the versions of the Microsoft .NET Framework that are affected
by this bug:
| .NET Framework Version |
Operating System |
Affected |
| 1.0 |
Windows 2000 Professional |
No |
| 1.0 |
Windows 2000 Server |
No |
| 1.0 |
Windows XP Professional |
Yes |
| 1.0 |
Windows Server 2003 |
No |
| 1.1 |
Windows 2000 Professional |
No |
| 1.1 |
Windows 2000 Server |
No |
| 1.1 |
Windows XP Professional |
No |
| 1.1 |
Windows Server 2003 |
No |
Back
to the top
To work around this bug, run the batch file that is
described in the "Batch File" section of this article. This batch
file does the following:
| 1. |
Stops the IIS and the ASP.NET state
services. |
| 2. |
Deletes and then re-creates the ASPNET account
by using a known temporary password. |
| 3. |
Uses the Windows runas command to start
an executable that creates an ASPNET user profile. An ASPNET
user profile works around the issue. |
| 4. |
Reregisters ASP.NET. This step creates a new
random password for the account and applies default ASP.NET
access control settings for the account. |
| 5. |
Restarts the Microsoft Internet Information
Services (IIS) service. |
The batch file
contains a hard-coded temporary password of "1pass@word". You will
be prompted to enter this password for the
runas command when
the batch file runs. After the
runas command has completed,
the ASPNET account password is re-created by using a strong random
value.
Important Notes
| • |
The batch file may fail if the hard-coded
password does not meet the password complexity requirements in
your environment. If this problem occurs, you can change the
password to another value that is appropriate for your
environment. |
| • |
If you have added custom access control
settings or database account permissions for the ASPNET
account, you must re-create these settings or permissions
after this batch file has completed. This is because a new
security identifier (SID) is assigned to this account when the
account is re-created. |
| • |
If you are running the ASP.NET worker process
by using a custom account that is different from the ASPNET
account, do not run this batch file. Instead, you must log on
to the computer interactively or you must use the runas
command with that custom account. This procedure creates a
user profile for the custom account. |
To use
the batch file, follow these steps.
Note Your account
must be a member of the Administrators group.
| 1. |
Start Notepad. Verify that Word Wrap is turned off. |
| 2. |
Paste the batch file code in Notepad. |
| 3. |
Save the file as c:\fixup.cmd. |
| 4. |
Click Start, and
then click Run. |
| 5. |
Type cmd.exe, and
then press ENTER. |
| 6. |
At the command prompt, type c:\fixup.cmd, and then press
ENTER. |
| 7. |
When you are prompted for a password, type
1pass@word.
A second
command prompt window appears. |
| 8. |
After you apply the patch, type exit in the second command prompt
window, and then press ENTER. |
| 9. |
If you previously configured custom access
control settings or database account permissions for the
ASPNET account, you must now reapply these
settings. |
Back
to the top
Batch File
REM Start Batch File
REM This batch file addresses issues that exist with the MS03-32
REM Security Update when you run ASP.NET 1.0 on Windows XP.
REM If you have any other configuration, do not run this file.
@echo off
if exist %SystemRoot%\microsoft.net\framework\v1.1* goto v11_installed
REM Change to the .NET Framework installation directory.
cd /d %SystemRoot%\microsoft.net\framework\v1.0.3705
echo "Stopping IIS."
iisreset /stop
echo "----------------------"
echo "Stopping the ASP.NET state service if it is running."
net stop aspnet_state
echo "----------------------"
echo "Deleting the ASPNET account."
net user ASPNET /delete
echo "----------------------"
echo "Creating a new ASPNET account with a temporary password."
net user ASPNET 1pass@word /add
echo "----------------------"
echo "Launching runas to create a profile."
echo "You see a command window being created."
echo "Type 1pass@word when you are prompted for the temporary password."
runas /profile /user:ASPNET cmd.exe
echo "----------------------"
echo "Reregistering ASP.NET and the ASPNET account."
aspnet_regiis -i
echo "A new random password has been autocreated for the ASPNET account."
echo "----------------------"
echo "Restarting IIS."
iisreset /start
echo "----------------------"
echo "The workaround has been applied."
echo "Try to access an ASP.NET page."
echo "If you have any custom access controls settings for the ASPNET account,"
echo "you must re-create them."
echo "If you were running the ASP.NET state service, you must restart it."
goto done
:v11_installed
echo "Version 1.1 appears to be installed. Do not run this file."
:done
REM End of batch file.
Back
to the top
Microsoft has confirmed that this is a bug in the
Microsoft products that are listed at the beginning of this article.
Back
to the top
