After installing MS07-045 Cumulative Security Update for Internet Explorer - CreateObject call fails with 8000ffff

  • Article

We have noticed an issue of CreateObject call failure after installing MS07-045 IE update. This issues goes away if you uninstall the patch.  As per the information available it's happening only when .NET managed component (using interop) is called from an ASP page.

Error shown in the browser looks like below

Server object error 'ASP 0177 : 8000ffff'
Server.CreateObject Failed
/hellocom.asp, line 2
8000ffff

Repro steps given below

  • Install MS07-045 security patch
  • Create a .NET managed component (helloworld.dll)
  • Make it COM visible and register it using "regasm helloworld.dll /codebase"
  • Create an ASP page (inside your website folder) which calls this component using CreateObject (hellocom.asp)
  • The page fails with the error mentioned above

For repro and testing I'm attaching following repro files

  • helloworld.dll (managed component)
  • hellocom.asp (which uses the above component using CreateObject call)

Code inside helloworld.dll

 using System;
using System.Collections.Generic;
using System.Text;

    public class HelloWorldClass
    {
        public HelloWorldClass() 
        {}

        public String SayHello()
        {
            return "Hello World!";
        }
    }

Code inside hellocom.asp

 <%   1:  

   2: Set hello = Server.CreateObject("HelloWorldClass")

   3: Response.Write hello.SayHello()

%>

In my repro I get access denied for these registry keys for IUSR account

Accessdenied 

Till an official update is available on this issue, please run regmon and fix the permission issues shown in the logs. Please give permission to only the user account shown in regmon logs and not for everyone group since it would increase security risk.

For testing if the permission requirement is only for IUSR account, add IUSR account to administrators group and test. In my case it works and confirms that it's missing permission only for IUSR. This step is for only for testing and needs to be reverted immediately.

Uninstalling this patch is not recommended since it's a security update.

HelloWorld.zip