April 8/08 Windows Updates break Yahoo MusicMatch Jukebox

[Wiz Feinberg]

When Microsoft released its April 8, 2008 critical updates, one of them was to disable a particular ActiveX control, which if exploited could lead to total system takeover. The Microsoft Technet article about this is Microsoft Security Bulletin MS08-023 - Security Update of ActiveX Kill Bits (948881).

Normally, Microsoft only provides updates to its own components and applications. Indeed, this security patch is meant to protect Internet Explorer users from the vulnerable ActiveX control loading from a hostile, or compromised website. But, in an commendable gesture to Yahoo, a company Microsoft is trying to take over, the patch was extended to kill the same vulnerable ActiveX control that Yahoo had installed into their "Music Jukebox." The method used by this patch is the modification of the Windows Registry to set a "KillBit" for the affected ActiveX control. This is like giving the system a shot. If the control is already present it will fail to load when the application using it is opened. If the control is not already on the computer, it never can be installed.

Windows PC users who have the Yahoo Music Jukebox may have noticed that it stopped functioning after Tuesday, April 8, 2008. Setting that KillBit effectively kills the Jukebox, for your own good. You need to go to the Yahoo Music Jukebox download page and download the patched version of the Jukebox. If your computer has any version of Yahoo! Music Jukebox earlier than 2.2.2.058 installed, you are affected. Canadian users can download the jukebox here.

If you choose not to update, the vulnerability will still exist on your computer, whether or not you run the Yahoo! Music Jukebox application. You will be prompted to install the update each time you run the Yahoo! Music Jukebox application. If you do not install the update when prompted, the application will close and you will not be able to access the Jukebox services.