DetailPage-MSS-KB

Microsoft small business knowledge base

Article ID: 918043 - Last Review: August 30, 2007 - Revision: 2.7

Important It is time to move to Microsoft Windows Server Update Services (WSUS). Software Update Services (SUS) 1.0 support time is running out. Besides the current capabilities in SUS 1.0, WSUS does the following:
  • Updates more than just Windows
  • Provides reporting and targeting capabilities
  • Gives administrators more control over the update process
For more information about WSUS, visit the following Microsoft Web site:
http://technet.microsoft.com/en-us/wsus/default.aspx (http://technet.microsoft.com/en-us/wsus/default.aspx)
Note This article applies only to releases on the Microsoft Windows Update Web site. This article does not apply to security releases for products that are not supported by Windows Update.

On This Page

SUMMARY

This article is intended for use by administrators of Microsoft Software Update Services (SUS) and Windows Server Update Services (WSUS) servers. This article contains a cumulative list of content changes that have been made available for SUS and WSUS servers. Administrators can use this list both as a quick reference to content changes that have been made during routine synchronizations and as an explanation of these changes. This information will be updated either during our regular update releases on the second Tuesday of every month or whenever an unscheduled update is released. This article lists changes that were made on or after February 8, 2005. This article does not list changes that were made before that date.

INTRODUCTION

This article contains a cumulative list of content changes that have been made available to Microsoft Software Update Services (SUS) and Windows Server Update Services (WSUS) servers on or after February 8, 2005.

MORE INFORMATION

Tuesday, December 20, 2005

Microsoft has released an updated version of the Approval Analyzer tool. The following Microsoft Knowledge Base article has been updated:
912307  (http://support.microsoft.com/kb/912307/ ) Previously approved software updates may be unapproved if you synchronize a server that is running SUS 1.0 with Service Pack 1 after December 12, 2005
The new version of the Approval Analyzer tool addresses an issue that was discovered after Tuesday, December 13, 2005. Because of this issue, some updates that were not approved by the SUS administrator could be deployed. This issue only affected the original version of the Approval Analyzer tool. Therefore, if you have already followed the steps in article 912307, you do not have to take additional action.

If you have not taken steps to address the issue that is discussed in article 912307, or if you have run the original version of the Approval Analyzer tool, you should download and run the new version of the tool.

Tuesday, December 13, 2005

Microsoft is receiving reports of a Software Update Services (SUS) issue after content that was published on Tuesday, December 13, 2005, is synchronized. SUS administrators have reported that all previously approved updates are no longer approved and that their status appears as "updated." For more information, click the following article number to view the article in the Microsoft Knowledge Base:
912307  (http://support.microsoft.com/kb/912307/ ) Previously approved software updates may be unapproved if you synchronize a server that is running SUS 1.0 with Service Pack 1 after December 12, 2005

New security content

  • MS05-054: Cumulative security update for Internet Explorer (KB905915)

    Locale: All
    Deployment: Windows Update, Microsoft Update, Windows Update Catalog, Microsoft Update Catalog, Automatic Updates, SUS 1.0, and WSUS
    Classification: Security
    Target operating systems: Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000, Microsoft Windows Millennium Edition, and Microsoft Windows 98 Second Edition
    Security severity rating:
    • Critical for all operating systems except the original release version of Windows Server 2003 and Windows Server 2003 Service Pack 1 (SP1)
    • Moderate for the original release version of Windows Server 2003 and for Windows Server 2003 SP1
    Approximate file sizes:
    • Windows 2000 update: 3,978 kilobytes (KB)
    • Windows XP update: 4,864 KB
    • Windows Server 2003 update: 7,434 KB
    Security issues have been identified that could let an attacker compromise a computer that is running Microsoft Internet Explorer and to gain control over it. You can help protect the computer by installing this update from Microsoft. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    905915  (http://support.microsoft.com/kb/905915/ ) MS05-054: Cumulative security update for Internet Explorer
  • MS05-055: Vulnerability in Windows kernel could allow elevation of privilege (KB908523)

    Locale: All
    Deployment: Windows Update, Microsoft Update, Windows Update Catalog, Automatic Updates, SUS 1.0, and WSUS
    Classification: Security
    Target operating systems: Microsoft Windows 2000
    Security Severity Rating: Important
    Approximate file size: 1,565 KB

    A security issue has been identified in Microsoft Windows-based systems that could let an attacker who successfully exploits this vulnerability take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts that have full user rights. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    908523  (http://support.microsoft.com/kb/908523/ ) MS05-055: Vulnerability in Windows kernel could allow elevation of privilege

Changes to existing security content

  • MS05-050: Vulnerability in DirectShow could allow remote code execution (KB904706)
    • Updated the binaries with specific targeting restrictions to prevent installation failures.
    • Updated detection.
    • Changed binaries.
    MS05-050 has several versions, depending on the target operating system and the version of DirectX that is installed. Therefore, even though you may have already installed security update 904706 (MS05-050) from the Download Center, you may have deployed the wrong version of this update. Rescan by using Windows Update or by using WSUS to make sure that the correct version of this update is installed on the system. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    904706  (http://support.microsoft.com/kb/904706/ ) MS05-050: Vulnerability in DirectShow could allow remote code execution

New nonsecurity content

  • The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000 (KB890830)

    Locale: All
    Deployment: Windows Update, Microsoft Update, Automatic Updates, and WSUS
    Classification: High priority, nonsecurity, update rollup
    Target operating systems: Microsoft Windows Server 2003, Microsoft Windows XP, and Microsoft Windows 2000

    After the download, this tool runs one time to examine a computer for infection by specific, prevalent malicious software. This malicious software includes Blaster, Sasser, and Mydoom. This tool helps remove any infection that it finds. If it finds an infection, the tool displays a status report the next time that you start the computer. A new version of the tool will be offered every month. If you want to manually run the tool, you can download a copy from the Microsoft Download Center or run an online version from Microsoft.com. This tool does not replace an antivirus product. To help protect a computer, use an antivirus product. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890830  (http://support.microsoft.com/kb/890830/ ) The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000
  • You cannot restore Windows XP with Service Pack 2 after you restore Windows XP with Service Pack 1 (KB835409)

    Locale: All
    Deployment: Windows Update, Microsoft Update, Windows Update Catalog, Microsoft Update Catalog, Automatic Updates, SUS 1.0, and WSUS
    Classification: High priority, nonsecurity
    Target operating systems: Microsoft Windows XP
    Approximate file size: 550 KB

    Install this update on Windows XP Service Pack 1 systems to resolve the following issue: System Restore may not work correctly, or certain services may not function correctly after you use System Restore. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    835409  (http://support.microsoft.com/kb/835409/ ) You cannot restore Windows XP with Service Pack 2 after you restore Windows XP with Service Pack 1
  • Microsoft Office Outlook 2003 may stop responding on a computer that is running Windows Server 2003 or Windows XP (KB908521)

    Locale: All
    Deployment: WSUS only
    Classification: Optional update, nonsecurity
    Target operating systems: Microsoft Windows Server 2003 and Microsoft Windows XP
    Approximate file sizes:
    • Windows XP update: 800 KB
    • Windows Server 2003 update: 832 KB
    Install this update to resolve various issues that can occur when you use remote procedure call (RPC) for client/server communication in Microsoft Windows Server 2003 and in Microsoft Windows XP. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    908521  (http://support.microsoft.com/kb/908521/ ) Office Outlook 2003 may stop responding on a computer that is running Windows Server 2003 or Windows XP
  • When Windows Automatic Updates tries to download updates on a Windows Server 2003-based or Windows XP-based computer, an access violation error may occur (KB910437)

    Locale: All
    Deployment: Windows Update, Microsoft Update, Windows Update Catalog, Microsoft Update Catalog, Automatic Updates, SUS 1.0, and WSUS
    Classification: High priority, nonsecurity, update
    Target operating systems: Microsoft Windows Server 2003 and Microsoft Windows XP
    Approximate file sizes:
    • Windows XP update: 1,166 KB
    • Windows Server 2003 update: 1,298 KB
    Install this update to prevent or to resolve an issue where an access violation error occurs when you use the Automatic Updates service. When this error occurs, Windows Update and Automatic Updates can no longer download updates. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    910437  (http://support.microsoft.com/kb/910437/ ) When Windows Automatic Updates tries to download updates on a Windows Server 2003-based or Windows XP-based computer, an access violation error may occur

Changes to existing nonsecurity content

  • Microsoft Deploying .NET Applications Lifecycle Guide (KB829019)
    • Changed targeting to deploy only in English.
    • Deployment: Windows Update, Microsoft Update, Windows Update Catalog, Microsoft Update Catalog, and WSUS
    • Binaries have not changed.
    • This update does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    829019  (http://support.microsoft.com/kb/829019/ ) Benefits of the Microsoft .NET Framework
  • Description of Windows SharePoint Services 2.0 Service Pack 2 (KB887624)
    • Metadata change only. Updated description text and updated detection metadata.
    • Binaries have not changed.
    • This update does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    887624  (http://support.microsoft.com/kb/887624/ ) Description of Windows SharePoint Services 2.0 Service Pack 2
  • Update Rollup 2 for Windows XP Media Center Edition 2005 (KB900325)
    • Metadata change only. Updated the coinstall metadata.
    • Binaries have not changed.
    • This update does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    900325  (http://support.microsoft.com/kb/900325/ ) Update Rollup 2 for Windows XP Media Center Edition 2005
Removed content
  • Description of the Windows Genuine Advantage Notifications application (Norwegian article version) (KB905474)
    Description of the Windows Genuine Advantage Notifications application (Swedish article version) (KB905474)

    Locale: Norwegian and Swedish
    Deployment: Windows Update, Microsoft Update, and Automatic Updates
    905474  (http://support.microsoft.com/kb/905474/no/ ) Description of the Windows Genuine Advantage Notifications application (Norwegian article version)

    905474  (http://support.microsoft.com/kb/905474/sv/ ) Description of the Windows Genuine Advantage Notifications application (Swedish article version)

Tuesday, November 29, 2005

New nonsecurity content

  • Description of the Windows Genuine Advantage Notifications application (Norwegian article version) (KB905474)
    Description of the Windows Genuine Advantage Notifications application (Swedish article version) (KB905474)


    Operating system locale: Norwegian and Swedish
    Deployment: Windows Update, Microsoft Update, and Automatic Updates
    Classification: Critical
    File size: 940.76 KB
    The Windows Genuine Advantage Notification tool indicates whether a copy of Windows is not genuine. If a system is found to be non-genuine, the tool will help the user to obtain a licensed copy of Windows.
    905474  (http://support.microsoft.com/kb/905474/no/ ) Description of the Windows Genuine Advantage Notifications application (Norwegian article version)

    905474  (http://support.microsoft.com/kb/905474/sv/ ) Description of the Windows Genuine Advantage Notifications application (Swedish article version)
  • Windows SharePoint Services 2.0 Service Pack 2 (KB887624)

    Operating system locale: Thai
    Deployment: Windows Update, Microsoft Update, SUS, and WSUS
    Classification: Service Pack
    File size: 5,124 KB
    Microsoft Windows SharePoint Services Service Pack 2 (SP2) provides the latest updates to Windows SharePoint Services. This service pack contains significant security enhancements and stability and performance improvements. After you install the service pack, you may have to restart the computer. After you have installed these updates, they cannot be removed. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    887624  (http://support.microsoft.com/kb/887624/ ) Description of Windows SharePoint Services 2.0 Service Pack 2
  • An update is available for SQL Server 2000 Desktop Engine (SHAREPOINT) (KB909544)

    Operating system locale: All
    Deployment: Windows Update, Microsoft Update, and WSUS
    Classification: Optional
    File size: 29,028.7 KB
    Install this package to update the Microsoft SQL Server 2000 Desktop Engine (Windows) component that is used by Windows Sharepoint Services (WSS). After you install this item, you may have to restart the computer. After you have installed this package, it cannot be removed. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    909544  (http://support.microsoft.com/kb/909544/ ) An update is available for SQL Server 2000 Desktop Engine (SHAREPOINT)
  • Description of the software update for Base Smart Card Cryptographic Service Provider (KB909520)

    Operating system locale: All
    Deployment: Windows Update, Microsoft Update
    Classification: Optional
    File size: 626.28 KB
    Base Smart Card Cryptographic Service Provider (Base CSP) package makes it easy for smart card vendors to enable their smart cards in Windows. Vendors can use a lightweight proprietary card module instead of a full proprietary CSP. After you install this package, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    909520  (http://support.microsoft.com/kb/909520/ ) Description of the software update for Base Smart Card Cryptographic Service Provider
  • An update is available for Windows Media Connect 2.0 (KB909993)

    Operating system locale: All
    Deployment: Windows Update, Microsoft Update
    Classification: Optional
    File size: 6,604.21 KB
    Microsoft Windows Media Connect enables you to deliver music, photos, and videos from a computer to devices that support UPnP media streaming. These devices include digital audio receivers, connected DVD players, digital cable set-top boxes, gaming consoles, and more. After you install Windows Media Connect, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    909993  (http://support.microsoft.com/kb/909993/ ) An update is available for Windows Media Connect 2.0
  • FIX: Protected content may no longer play after you install Update Rollup 2 for Windows XP Media Center Edition 2005 (KB910393)

    Operating system locale: All
    Deployment: Windows Update, Microsoft Update, Automatic Updates, and WSUS
    Classification: High priority, nonsecurity
    File Size: 1,408.26 KB
    Install this update to prevent Windows Media Player 10 setup from overwriting digital rights management (DRM) files that are installed by Update Rollup 2 for Windows XP Media Center Edition 2005 (KB900325). After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    910393  (http://support.microsoft.com/kb/910393/ ) FIX: Protected content may no longer play after you install Update Rollup 2 for Windows XP Media Center Edition 2005

Changes to existing nonsecurity content

  • Windows SharePoint Services 2.0 Service Pack 2 (KB887624)
    • There was a problem with the Dutch binary that prevented a successful installation.
    • The Dutch binary has changed.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    887624  (http://support.microsoft.com/kb/887624/ ) Description of Windows SharePoint Services 2.0 Service Pack 2

Friday, November 11, 2005

New security content

There is no new security content in this release.

Changes to existing security content

There is no change to existing security content

New nonsecurity content

There is no new nonsecurity content in this release.

Changes to existing nonsecurity content

  • The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000 (KB890830)
    • Binaries have been changed.
    • If you have successfully run the Microsoft Windows Malicious Software Removal Tool, you do not have to redeploy it.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890830  (http://support.microsoft.com/kb/890830/ ) The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000

Tuesday, November 8, 2005

New security content

  • Microsoft Security Bulletin MS05-053: Vulnerabilities in graphics rendering engine could allow code execution (KB896424)

    Bulletin Severity: Critical
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000, Microsoft Windows Millennium Edition, Microsoft Windows 98 Second Edition

    A remote code execution security issue has been identified in the Graphics Rendering Engine that could let an attacker remotely compromise a Windows-based system and to gain control over the system. You can help protect a computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896424  (http://support.microsoft.com/kb/896424/ ) Microsoft Security Bulletin MS05-053: Vulnerabilities in graphics rendering engine could allow code execution

Changes to existing security content

  • MS03-030: Unchecked buffer in DirectX could enable system compromise (KB819696)
    • Only metadata has changed.
    • Updated detection to prevent reoffering.
    • Binaries have not changed.
    • You do not have to reinstall this security update.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    819696  (http://support.microsoft.com/kb/819696/ ) MS03-030: Unchecked buffer in DirectX could enable system compromise
  • MS03-022: Vulnerability in ISAPI Extension for Windows Media Services may cause code execution (KB822343)
    • Only metadata has changed.
    • Updated detection to prevent reoffering.
    • Binaries have not changed.
    • You do not have to reinstall this security update.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    822343  (http://support.microsoft.com/kb/822343/ ) MS03-022: Vulnerability in ISAPI extexsion for Windows Media Services may cause code execution
  • Microsoft has released a security update to Microsoft Windows Media Player 9 (KB885492)
    • Only metadata has changed.
    • Updated detection to correctly offer to WS03.
    • Binaries have not changed.
    • Changed severity to Critical to match bulletin.
    • You do not have to reinstall this security update.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    885492  (http://support.microsoft.com/kb/885492/ ) Microsoft has released a security update to Microsoft Windows Media Player 9
  • MS05-032: Vulnerability in Microsoft agent could allow spoofing (KB890046)
    • Only metadata has changed.
    • Updated targeting.
    • Binaries have not changed.
    • You do not have to reinstall this security update.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890046  (http://support.microsoft.com/kb/890046/ ) MS05-032: Vulnerability in Microsoft agent could allow spoofing
  • MS05-030: Vulnerability in Outlook Express could allow remote code execution (KB897715)
    • Only metadata has changed.
    • Updated detection to prevent reoffering.
    • Binaries have not changed.
    • You do not have to reinstall this security update.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    897715  (http://support.microsoft.com/kb/897715/ ) MS05-030: Vulnerability in Outlook Express could allow remote code execution
Microsoft Software Update Services removals
  • MS02-054: Unchecked buffer in file decompression functions may allow attacker to run code (KB329048)

New nonsecurity content

  • The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000 (KB890830)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    After the download, this tool runs one time to check a computer for infection by specific, prevalent, malicious software. This malicious software includes Blaster, Sasser, and Mydoom. This tool also helps remove any infection that is found. If an infection is found, the tool displays a status report the next time that you start the computer. A new version of the tool will be offered every month. If you want to manually run the tool on a computer, download a copy from the Microsoft Download Center or run an online version from microsoft.com. This tool does not replace an antivirus product. To help protect a computer, use an antivirus product. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890830  (http://support.microsoft.com/kb/890830/ ) The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000
  • Microsoft Deploying .NET Applications Lifecycle Guide (KB829019)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    The Microsoft .NET Framework version 2.0 improves scalability and performance with the following features:
    • Improved caching
    • Application deployment and updating by using ClickOnce
    • Support for the broadest array of browsers and devices that have ASP.NET 2.0 controls and services
    After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    829019  (http://support.microsoft.com/kb/829019/ ) Benefits of the Microsoft .NET Framework
  • Description of Windows SharePoint Services 2.0 Service Pack 2 (KB887624)

    Microsoft Windows Server 2003
    Hindi, Thai, Bulgarian, Croatian, Estonian, Latvian, Lithuanian, Romanian, Serbian (Latin), Slovak, Slovenian, and Ukrainian

    Windows SharePoint Services Language Template Pack Service Pack 2 guarantees that Windows SharePoint Services performs with full functionality when a Language Template Pack is installed. After you install this item, you may have to restart the computer. After you install this item, it cannot be removed. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    887624  (http://support.microsoft.com/kb/887624/ ) Description of Windows SharePoint Services 2.0 Service Pack 2

Changes to existing nonsecurity content

  • How to disable the ADODB.Stream object from Internet Explorer (KB870669)
    • This item was superseded by security bulletin MS05-052. It is typical to keep superseded content available in SUS for one year. However, this item was unintentionally removed from SUS on October 12, 2005. We are republishing this item as an SUS-only item, where it will remain until October, 2006.
    • Only metadata has changed. No other changes.
    • Binaries have not changed.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    870669  (http://support.microsoft.com/kb/870669/ ) How to disable the ADODB.Stream object from Internet Explorer
Microsoft Software Update Services removals
  • Media Center recordings may be deleted when you change the recording storage location (KB838358)
  • You cannot log on to a Web site or complete an Internet transaction, or you receive an HTTP 500 (Internal Server Error) Web page (KB831167)

Tuesday, October 25, 2005

Changes to existing security content

  • MS05-044: Vulnerability in the Windows FTP client could allow file transfer location tampering (KB905495)

    Note The changes are only to Microsoft Software Update Services 1.0.
    • Only metadata has changed.
    • The forward link has been updated to link to the correct bulletin.
    • Binaries have not changed.
    • You do not have to reinstall this security update.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    905495  (http://support.microsoft.com/kb/905495/ ) MS05-044: Vulnerability in the Windows FTP client could allow file transfer location tampering
  • MS05-051: Vulnerabilities in MS DTC and COM+ could allow remote code execution (KB902400)

    Note The changes are only to Microsoft Software Update Services 1.0. The bulletin information has changed.

    Microsoft Windows 2000
    • Metadata has changed for the Windows 2000 version of security bulletin MS05-051. The metadata was changed to remove MS04-012 from the superseded security bulletin list. Security bulletin MS05-051 for Windows 2000 does not supersede the Windows 2000 version of security bulletin MS04-012.
    • Binaries have not changed.
    • You do not have to reinstall this security update.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    902400  (http://support.microsoft.com/kb/902400/ ) MS05-051: Vulnerabilities in MS DTC and COM+ could allow remote code execution

New nonsecurity content

Priority updates – AutoUpdate and WSUS (SUS 2.0)
  • Office programs may stop responding when you save a new file to a floppy disk drive on a Windows 2000-based computer that has Update Rollup 1 for Windows 2000 SP4 installed (KB904368)

    Microsoft Windows 2000 Service Pack 4

    Install this update to resolve an issue in which Microsoft Office programs may stop responding when you try to save new files to a floppy disk drive after you install Update Rollup 1 for Windows 2000 Service Pack 4. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    904368  (http://support.microsoft.com/kb/904368/ ) Office programs may stop responding when you save a new file to a floppy disk drive on a Windows 2000-based computer that has Update Rollup 1 for Windows 2000 SP4 installed
Optional updates – not Priority, not AutoUpdate, not WSUS or SUS
  • An update for Windows Media Digital Rights Management-enabled players is available (KB891122)

    Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2

    Install this update to enable a computer to access premium content that is protected by Windows Media Digital Rights Management. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    891122  (http://support.microsoft.com/kb/891122/ ) An update for Windows Media Digital Rights Management-enabled players is available
  • FIX: Some portable devices may take 30 seconds or longer to start playing back a piece of content when you play subscription content that is protected by Windows Media DRM that uses chained licenses (KB902344)

    Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2

    Install this update on a computer if you use a portable device that accesses subscription media content that is protected by Windows Media Digital Rights Management. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    902344  (http://support.microsoft.com/kb/902344/ ) FIX: Some portable devices may take 30 seconds or longer to start playing back a piece of content when you play subscription content that is protected by Windows Media DRM that uses chained licenses

Changes to existing nonsecurity content

Priority updates – AutoUpdate and WSUS (SUS 2.0)
  • Update Rollup 908250 is available for computers that are running Update Rollup 2 for Microsoft Windows XP Media Center Edition 2005 (KB908250)

    Microsoft Windows XP Media Center Edition 2005
    • Only metadata has changed. The classification was upgraded from an Optional update to Priority/AutoUpdate. Localized titles and the support URL have been corrected.
    • Binaries have not changed.
    • You do not have to reinstall this update.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    908250  (http://support.microsoft.com/kb/908250/ ) Update Rollup 908250 is available for computers that are running Update Rollup 2 for Microsoft Windows XP Media Center Edition 2005

Thursday, October 13, 2005

New security content

There is no new security content in this release.

Changes to existing security content

Note These changes are only to Windows Software Update Services (WSUS). These changes do not affect SUS 1.0.
Updated deployment method
  • MS05-052: Cumulative security update for Internet Explorer (KB896688)
    • Microsoft Windows XP SP2 only.
    • Updated deployment method to improve download performance.
    • Binaries did not change.
    • You do not have to reinstall this security update.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896688  (http://support.microsoft.com/kb/896688/ ) MS05-052: Cumulative security update for Internet Explorer
Change in severity rating from "Critical" to "Important"
  • MS05-049: Vulnerabilities in the Windows shell could allow for remote code execution (KB900725)
    • Metadata change only.
    • Bulletin and communications correctly listed this update as "Important," but WSUS incorrectly listed this update as "Critical." This update has been re-released as "Important."
    • Binaries did not change.
    • You do not have to reinstall this security update.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    900725  (http://support.microsoft.com/kb/900725/ ) MS05-049: Vulnerabilities in the Windows shell could allow for remote code execution
Update to replacement information
  • MS05-047: Vulnerability in Plug and Play could allow remote code execution and local elevation of privilege (KB905749)
    • Metadata change only.
    • The metadata has been updated to show that this update supersedes the previously released update 899588 (MS05-039).
    • Binaries did not change.
    • You do not have to reinstall this security update.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    905749  (http://support.microsoft.com/kb/905749/ ) MS05-047: Vulnerability in Plug and Play could allow remote code execution and local elevation of privilege
Forward link update
  • MS05-044: Vulnerability in the Windows FTP client could allow file transfer location tampering (KB905495)
    • Metadata change only.
    • The forward link has been updated to link to the correct bulletin.
    • Binaries did not change.
    • You do not have to reinstall this security update.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    905495  (http://support.microsoft.com/kb/905495/ ) MS05-044: Vulnerability in the Windows FTP client could allow file transfer location tampering

New nonsecurity content

There is no new nonsecurity content in this release.

Changes to existing nonsecurity content

There are no changes to existing nonsecurity content in this release.

Tuesday, October 11, 2005

New security content

  • MS05-052: Cumulative security update for Internet Explorer (KB896688)

    Bulletin Severity: Critical
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000, Microsoft Windows Millennium Edition, Microsoft Windows 98 Second Edition

    Security issues have been identified that could allow an attacker to compromise a computer that is running Microsoft Internet Explorer and gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896688  (http://support.microsoft.com/kb/896688/ ) MS05-052: Cumulative security update for Internet Explorer
  • MS05-051: Vulnerabilities in MS DTC and COM+ could allow remote code execution (KB902400)

    Bulletin Severity: Critical
    Microsoft Windows XP SP1, Microsoft Windows 2000

    Bulletin Severity: Important
    Microsoft Windows XP SP2, Microsoft Windows Server 2003

    A remote code execution security issue has been identified that could allow an attacker to remotely compromise a Windows-based system and gain control over it. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    902400  (http://support.microsoft.com/kb/902400/ ) MS05-051: Vulnerabilities in MS DTC and COM+ could allow remote code execution
  • MS05-050: Vulnerability in DirectShow could allow remote code execution (KB904706)

    Bulletin Severity: Critical
    DirectX 8.1, DirectX 9.0, Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000, Microsoft Windows Millennium Edition, Microsoft Windows 98 Second Edition

    A security issue has been identified that could allow an attacker to remotely compromise a Windows-based system by using DirectShow and to gain control over the system. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    904706   (http://support.microsoft.com/kb/904706/ ) MS05-050: Vulnerability in DirectShow could allow remote code execution
  • MS05-049: Vulnerabilities in the Windows shell could allow for remote code execution (KB900725)

    Bulletin Severity: Important
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified that could allow an authenticated attacker to gain access to and potentially compromise a Microsoft Windows-based system. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    900725   (http://support.microsoft.com/kb/900725/ ) MS05-049: Vulnerabilities in the Windows shell could allow for remote code execution
  • Vulnerability in the Microsoft Collaboration Data Objects could allow code execution (Windows) (KB901017)

    Bulletin Severity: Important
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified that could allow an attacker to remotely compromise a Windows-based system by using Collaboration Data Objects (CDO) and to gain control over the system. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    901017   (http://support.microsoft.com/kb/901017/ ) Vulnerability in the Microsoft Collaboration Data Objects could allow code execution (Windows)
  • MS05-047: Vulnerability in Plug and Play could allow remote code execution and local elevation of privilege (KB905749)

    Bulletin Severity: Important
    Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified in the Plug and Play service that could allow an authenticated attacker to compromise a Microsoft Windows-based system and to gain control over the system. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    905749   (http://support.microsoft.com/kb/905749/ ) MS05-047: Vulnerability in Plug and Play could allow remote code execution and local elevation of privilege
  • MS05-046: Vulnerability in the Client Service for NetWare could allow remote code execution (KB899589)

    Bulletin Severity: Important
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified in the Client Service for NetWare that could allow an attacker to compromise a Microsoft Windows-based system and to gain control over the system, if you have installed this service. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    899589   (http://support.microsoft.com/kb/899589/ ) MS05-046: Vulnerability in the Client Service for NetWare could allow remote code execution
  • MS05-045: Vulnerability in Network Connection Manager could allow denial of service (KB905414)

    Bulletin Severity: Moderate
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A denial of service security issue has been identified that could cause the Network Manager service to stop responding on a Windows-based system. You can help protect a computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    905414   (http://support.microsoft.com/kb/905414/ ) MS05-045: Vulnerability in Network Connection Manager could allow denial of service
  • MS05-044: Vulnerability in the Windows FTP client could allow file transfer location tampering (KB905495)

    Bulletin Severity: Moderate
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000, Microsoft Windows Millennium Edition, Microsoft Windows 98 Second Edition

    A security issue has been identified that could allow an attacker to tamper with the file transfer location on a computer when you use the Microsoft Windows FTP (File Transfer Protocol) client. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    905495   (http://support.microsoft.com/kb/905495/ ) MS05-044: Vulnerability in the Windows FTP client could allow file transfer location tampering

Changes to existing security content

There are no changes to existing security content for this release.

New nonsecurity content

  • The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000 (KB890830)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    After the download, this tool runs one time to examine the computer for infection by specific, prevalent malicious software. (This software includes Blaster, Sasser, and Mydoom.) This tool helps remove any infection that it finds. If it finds an infection, the tool displays a status report the next time that you start the computer. A new version of the tool will be offered every month. If you want to manually run the tool on the computer, you can download a copy from the Microsoft Download Center or run an online version from Microsoft.com. This tool does not replace an antivirus product. To help protect the computer, use an antivirus product. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890830  (http://support.microsoft.com/kb/890830/ ) The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000
  • Windows SharePoint Services 2.0 Service Pack 2 (KB887624)

    Windows SharePoint Services Service Pack 2 (SP2) provides the latest updates to Windows SharePoint Services. This service pack contains significant security enhancements, in addition to stability and performance improvements. After you install this item, you may have to restart the computer. After you have installed this item, it cannot be removed. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    887624  (http://support.microsoft.com/kb/887624/ ) Description of Windows SharePoint Services 2.0 Service Pack 2
  • Windows SharePoint Services 2.0 Service Pack 2 (KB887624)

    Windows SharePoint Services Language Template Pack Service Pack 2 guarantees that Windows SharePoint Services performs with full functionality when a Language Template Pack is installed. After you install this item, you may have to restart the computer. After you have installed this item, it cannot be removed. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    887624  (http://support.microsoft.com/kb/887624/ ) Description of Windows SharePoint Services 2.0 Service Pack 2

Changes to existing nonsecurity content

There are no changes to existing nonsecurity content in this release.

Tuesday, September 13, 2005

Changes to existing security content

Updated detection to prevent a reoffering that was reported on a limited number of Microsoft Windows Server 2003-based systems that had no service packs installed
  • 893756  (http://support.microsoft.com/kb/893756/ ) MS05-040: Vulnerability in Telephony service could allow remote code execution
  • 896727  (http://support.microsoft.com/kb/896727/ ) MS05-038: Cumulative security update for Internet Explorer
  • 896428  (http://support.microsoft.com/kb/896428/ ) MS05-033: Vulnerability in Telnet client could allow information disclosure
  • 896422  (http://support.microsoft.com/kb/896422/ ) MS05-027: Vulnerability in Server Message Block could allow remote code execution
  • 896358  (http://support.microsoft.com/kb/896358/ ) MS05-026: A vulnerability in HTML Help could allow remote code execution
  • 899588  (http://support.microsoft.com/kb/899588/ ) MS05-039: Vulnerability in Plug and Play could allow remote code execution and elevation of privilege
  • 899587  (http://support.microsoft.com/kb/899587/ ) MS05-042: Vulnerabilities in Kerberos could allow denial of service, information disclosure, and spoofing
  • 890046  (http://support.microsoft.com/kb/890046/ ) MS05-032: Vulnerability in Microsoft agent could allow spoofing
  • 899591  (http://support.microsoft.com/kb/899591/ ) MS05-041: Vulnerability in Remote Desktop Protocol could allow denial of service
  • MS05-025: Cumulative security update for Internet Explorer (KB883939)
    • Detection was updated to prevent a reoffering that was reported on a limited number of Microsoft Windows Server 2003-based systems that had no service packs installed.
    • Binaries did not change.
    • You do not have to reinstall these security updates.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    883939  (http://support.microsoft.com/kb/883939/ ) MS05-025: Cumulative security update for Internet Explorer
Change severity rating
  • MS05-038: Cumulative security update for Internet Explorer (KB896727)
    • This change is to metadata only. Metadata showed severity incorrectly rated as Important. Re-releasing with severity accurately set to Critical.
    • Binaries did not change.
    • You do not have to reinstall security update 896727.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896727  (http://support.microsoft.com/kb/896727/ ) MS05-038: Cumulative Security Update for Internet Explorer

    887998  (http://support.microsoft.com/kb/887998/ ) ASP.NET path validation vulnerability in Microsoft .NET Framework 1.0 Service Pack 3 on Windows XP Media Center and Tablet PC Editions

    886903  (http://support.microsoft.com/kb/886903/ ) ASP.NET path validation vulnerability in Microsoft .NET Framework 1.1 Service Pack 1
  • ASP.NET path validation vulnerability in Microsoft .NET Framework 1.0 Service Pack 3 (KB886906)
    • This change is to metadata only. Metadata showed severity incorrectly rated as Critical. Re-releasing with severity accurately set to Important.
    • Binaries did not change.
    • You do not have to reinstall these security updates.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    886906  (http://support.microsoft.com/kb/886906/ ) ASP.NET path validation vulnerability in Microsoft .NET Framework 1.0 Service Pack 3
Metadata change to the installation command to resolve installation failures
  • MS03-044: Buffer overrun in Windows Help and Support Center could lead to system compromise (KB825119)
    • This change to metadata corrects switch settings to resolve installation failures.
    • Binaries did not change.
    • You do not have to reinstall security update 825119.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    825119  (http://support.microsoft.com/kb/825119/ ) MS03-044: Buffer overrun in Windows Help and Support Center could lead to system compromise
Text change
  • MS04-016: Vulnerability in DirectPlay could allow denial of service (KB839643)
    • This change is a metadata change to Text.
    • Binaries did not change.
    • You do not have to reinstall security update 839643.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    839643  (http://support.microsoft.com/kb/839643/ ) MS04-016: Vulnerability in DirectPlay could allow denial of service
Metadata change to restart settings
  • MS05-037: Vulnerability in JView Profiler could allow remote code execution (KB903235)
    • This change is a metadata change to restart settings.
    • Binaries did not change.
    • You do not have to reinstall security update 903235.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    903235  (http://support.microsoft.com/kb/903235/ ) MS05-037: Security Update for JView Profiler
Category change from IA-64 to x64
  • 896428  (http://support.microsoft.com/kb/896428/ ) MS05-033: Vulnerability in Telnet client could allow information disclosure
  • 896422  (http://support.microsoft.com/kb/896422/ ) MS05-027: Vulnerability in Server Message Block could allow remote code execution
  • 896358  (http://support.microsoft.com/kb/896358/ ) MS05-026: A vulnerability in HTML Help could allow remote code execution
  • MS05-025: Cumulative security update for Internet Explorer (KB883939)
    • This change is a metadata change to fix a category listing. There is no change to the way the package is offered.
    • Binaries did not change.
    • You do not have to reinstall these security updates.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    883939  (http://support.microsoft.com/kb/883939/ ) MS05-025: Cumulative security update for Internet Explorer

New nonsecurity content

  • The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000 (KB890830)
    Microsoft Windows Server 2003, Microsoft Windows XP, and Microsoft Windows 2000

    After the download, this tool runs one time to examine the computer for infection by specific, prevalent malicious software. This malicious software includes Blaster, Sasser, and Mydoom. The tool also helps remove any infection that is found. If an infection is found, the tool will display a status report the next time that you start the computer. A new version of the tool will be offered every month. If you want to run the tool on the computer manually, you can download a copy from the Microsoft Download Center or run an online version from microsoft.com. This tool does not replace an antivirus product. To help protect the computer, use an antivirus product. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890830  (http://support.microsoft.com/kb/890830/ ) The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000

Changes to existing nonsecurity content

  • Update Rollup 1 for Windows 2000 SP4 and known issues (KB891861)
    Microsoft Windows 2000 Service Pack 4
    • Binaries were updated.
    • You do not have to reinstall update 891861.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    891861  (http://support.microsoft.com/kb/891861/ ) Update Rollup 1 for Windows 2000 SP4 and known issues
  • A fix is available for a registry problem on Dell PowerEdge servers that have specific nonnative disk controllers and factory installed versions of Windows Server 2003 (KB898792)
    • Updated detection to prevent a reoffering that was reported on a limited number of Microsoft Windows Server 2003-based systems that had no service packs installed.
    • Binaries did not change.
    • You do not have to reinstall update 898792.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    898792  (http://support.microsoft.com/kb/898792/ ) A fix is available for a registry problem on Dell PowerEdge servers that have specific nonnative disk controllers and factory installed versions of Windows Server 2003
  • Windows XP Service Pack 2
    • Updated the superseded items list and the reference Knowledge Base number.
    • Binaries did not change.
    • You do not have to reinstall this service pack.

    Windows 2000 Service Pack 4 Network Install for IT Professionals
    • Chinese (Hong Kong) only.
    • Updated targeting.
    • Binaries did not change.
    • You do not have to reinstall this update.

Tuesday, August 9, 2005

New security content

  • MS05-038: Cumulative security update for Internet Explorer (KB896727)

    Bulletin Severity: Critical
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000, Microsoft Windows Millennium Edition, Microsoft Windows 98 Second Edition

    Security issues have been identified that could allow an attacker to compromise a computer that is running Microsoft Internet Explorer and to gain control over the computer. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896727  (http://support.microsoft.com/kb/896727/ ) MS05-038: Cumulative security update for Internet Explorer
  • MS05-039: Vulnerability in Plug and Play could allow remote code execution and elevation of privilege (KB899588)

    Bulletin Severity: Critical
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified in the Plug and Play service that could allow an attacker to compromise the Microsoft Windows-based system and to gain control over it. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    899588  (http://support.microsoft.com/kb/899588/ ) MS05-039: Vulnerability in Plug and Play could allow remote code execution and elevation of privilege
  • MS05-040: Vulnerability in Telephony service could allow remote code execution (KB893756)

    Bulletin Severity: Important
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified in the Telephony API (TAPI) that could allow an attacker to compromise the Microsoft Windows-based system and to gain control over it. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    893756  (http://support.microsoft.com/kb/893756/ ) MS05-040: Vulnerability in Telephony service could allow remote code execution
  • MS05-041: Vulnerability in Remote Desktop Protocol could allow denial of service (KB899591)

    Bulletin Severity: Moderate
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified in the Remote Desktop Protocol (RDP) that could allow an attacker to remotely cause the Microsoft Windows-based system to stop responding. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    899591  (http://support.microsoft.com/kb/899591/ ) MS05-041: Vulnerability in Remote Desktop Protocol could allow denial of service
  • MS05-042: Vulnerabilities in Kerberos could allow denial of service, information disclosure, and spoofing (KB899587)

    Bulletin Severity: Moderate
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified that could allow an attacker to gain access to sensitive data transmitted through the Microsoft Windows-based system in a domain environment and to perform denial of service attacks against domain controllers. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    899587  (http://support.microsoft.com/kb/899587/ ) MS05-042: Vulnerabilities in Kerberos could allow denial of service, information disclosure, and spoofing
  • MS05-043: Vulnerability in Print Spooler service could allow remote code execution (KB896423)

    Bulletin Severity: Critical
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified in the Print Spooler service that could allow an attacker to compromise the Microsoft Windows-based system and to gain control over it. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896423  (http://support.microsoft.com/kb/896423/ ) MS05-043: Vulnerability in Print Spooler service could allow remote code execution

Changes to existing security content

  • MS05-025: Cumulative Security Update for Internet Explorer for Windows Server 2003 (KB883939)
    • Updated detection to prevent a reoffering in Microsoft Windows Small Business Server.
    • Binaries did not change.
    • Update 883939 ( MS05-025) does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    883939  (http://support.microsoft.com/kb/883939/ ) MS05-025: Cumulative Security Update for Internet Explorer for Windows Server 2003
  • MS05-026: A vulnerability in HTML Help could allow remote code execution (KB896358)
    • Updated detection to prevent a reoffering on Windows Small Business Server.
    • Binaries did not change.
    • Update 896358 ( MS05-026) does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896358  (http://support.microsoft.com/kb/896358/ ) MS05-026: A vulnerability in HTML Help could allow remote code execution
  • MS05-027: Vulnerability in Server Message Block could allow remote code execution (KB896422)
    • Updated detection to prevent a reoffering in Windows Small Business Server.
    • Binaries did not change.
    • MS05-027 does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896422  (http://support.microsoft.com/kb/896422/ ) MS05-027: Vulnerability in Server Message Block could allow remote code execution
  • MS05-032: Vulnerability in Microsoft agent could allow spoofing (KB890046)
    • Microsoft updated this bulletin to advise customers that a revised version of the security update is available for the following systems:
      • Microsoft Windows Server 2003 for Itanium-based systems and Microsoft Windows Server 2003 with SP1 for Itanium-based systems
      • Microsoft Windows Server 2003, x64-based versions
      • Microsoft Windows XP Professional x64 Edition
    • Binaries did change.
    • Update 890046 (MS05-032) does have to be reinstalled on the systems listed above.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890046  (http://support.microsoft.com/kb/890046/ ) MS05-032: Vulnerability in Microsoft agent could allow spoofing
  • MS05-032: Vulnerability in Microsoft agent could allow spoofing (KB890046)
    • Updated detection to prevent a reoffering in Windows Small Business Server.
    • Binaries did not change.
    • Update 890046 (MS05-032) does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890046  (http://support.microsoft.com/kb/890046/ ) MS05-032: Vulnerability in Microsoft agent could allow spoofing
  • MS05-033: Vulnerability in Telnet client could allow information disclosure (KB896428)
    • Updated detection to prevent a reoffering on Windows Small Business Server.
    • Binaries did not change.
    • Update 896428 (MS05-033) does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896428  (http://support.microsoft.com/kb/896428/ ) MS05-033: Vulnerability in Telnet client could allow information disclosure
  • MS05-030: Vulnerability in Outlook Express could allow remote code execution (KB897715)
    • Title change to remove the word “cumulative." This update does not supersede any previously released Outlook Express cumulative update.
    • Updated detection so previously released Outlook Express cumulative security updates are offered and installed before this update is offered.
    • Binaries did not change.
    • Update 897715 (MS05-030) does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    897715  (http://support.microsoft.com/kb/897715/ ) MS05-030: Vulnerability in Outlook Express could allow remote code execution
  • MS04-018: Cumulative Security Update for Outlook Express (KB823353)
    • Update is no longer superseded by security bulletin MS05-030. Therefore, previous changes are reversed.
    • Binaries did not change.
    • Update 823353 (MS04-018) does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    823353  (http://support.microsoft.com/kb/823353/ ) MS04-018: Cumulative Security Update for Outlook Express
  • MS04-004: Cumulative Security Update for Internet Explorer (KB832894)
    • This item should remain static on the site as it is the last Internet Explorer 5.5 Service Pack 2 cumulative update that is available for Windows 2000.
    • Binaries did not change.
    • Update 832894 (MS04-004) does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    832894  (http://support.microsoft.com/kb/832894/ ) MS04-004: Cumulative Security Update for Internet Explorer
  • MS03-043: Security Update for Windows 2000 – SUS 1.0 (V4 only) (KB828035)
    • On June 28, 2005, this update was rereleased to comply with the initial release of Update Rollup 1 for Windows 2000 Service Pack 4 (SP4). It was noted after the June 28, 2005, release that the binaries that were used for the SP4-only version of 828035 appeared to be older than those that were originally released on Windows Update in October 2003. The correct binaries were reloaded into the SP4-only version of 828035, and that version was rereleased on August 9, 2005. Binaries did change. Update 828035 (MS03-043) may have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    828035  (http://support.microsoft.com/kb/828035/ ) MS03-043: Buffer overrun in Messenger service could allow code execution
  • MS03-007: Unchecked buffer in Windows component may cause Web Server compromise (KB815021)
    • The Windows XP version of 815021 is not superseded by security bulletin MS04-032. Therefore, this item is being returned to all channels.
    • Binaries did not change.
    • Update 815021 (MS03-007) does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    815021  (http://support.microsoft.com/kb/815021/ ) MS03-007: Unchecked buffer in Windows component may cause Web Server compromise
  • MS02-050: Certificate validation flaw might permit identity spoofing (KB329115)
    • Updated detection to prevent a reoffering if the Windows 2000 SP4 Update Rollup has been installed.
    • Binaries did not change.
    • Update 329115 (MS02-050) does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    329115  (http://support.microsoft.com/kb/329115/ ) MS02-050: Certificate validation flaw might permit identity spoofing
  • MS03-044: Buffer overrun in Windows Help and Support Center could lead to system compromise (KB825119)
    • Updated detection to prevent reoffering.
    • Binaries did not change.
    • Update 825119 (MS03-044) does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    825119  (http://support.microsoft.com/kb/825119/ ) MS03-044: Buffer overrun in Windows Help and Support Center could lead to system compromise

New nonsecurity content

  • The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000 (KB890830)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    After the download, this tool runs one time to examine the computer for infection by specific, prevalent malicious software. (This software includes Blaster, Sasser, and Mydoom.) and helps remove any infection that it finds. If an infection is found, the tool will display a status report the next time that you start the computer. A new version of the tool will be offered every month. If you want to manually run the tool on a computer, you can download a copy from the Microsoft Download Center or run an online version from Microsoft.com. This tool does not replace an antivirus product. To help protect a computer, you should use an antivirus product. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890830  (http://support.microsoft.com/kb/890830/ ) The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000
  • You receive a "Generic Host Process" error message after you start the computer, or DBCS attachment file names are not displayed in Rich Text e-mail messages (KB894391)

    Install this update to address an issue that may cause a "Generic Host Process" error message to appear after you install security update 894391 (MS05-012). The issue may also cause attachment file names not to be displayed in Rich Text e-mail messages. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    894391  (http://support.microsoft.com/kb/894391/ ) You receive a "Generic Host Process" error message after you start the computer, or DBCS attachment file names are not displayed in Rich Text e-mail messages
  • An update that addresses Outlook Express 6.0 issues is available for Windows XP (KB900930)

    Microsoft Windows XP Service Pack 2

    Install this update to address multiple Outlook Express issues in Windows XP. This update addresses an issue in which messages are incorrectly handled if the subject line contains the word “begin” and a display issue regarding watched threads in newsgroups. This update also addresses two issues in which Outlook Express stops responding. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    900930  (http://support.microsoft.com/kb/900930/ ) An update that addresses Outlook Express 6.0 issues is available for Windows XP
  • Memory leak in Windows XP Tablet PC Edition (KB895953)

    Microsoft Windows XP Tablet PC Edition 2005

    Install this update to address an issue causing a gradual decrease in available system memory in Windows XP Tablet PC Edition 2005. This loss in available memory causes a decrease in system performance. This gradual loss of available computer memory is caused by an issue in the tcserver.exe service. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    895953  (http://support.microsoft.com/kb/895953/ ) Memory leak in Windows XP Tablet PC Edition

Changes to existing nonsecurity content

  • Description of the cumulative update for Outlook Express (KB887797)
    • Update is no longer superseded by security bulletin MS05-030. Therefore, previous changes were reversed.
    • Updated the WS03 version to include a prerequisite detection change that was implemented for all other operating system versions of this update.
    • Binaries did not change.
    • Update 887797 does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    887797  (http://support.microsoft.com/kb/887797/ ) Description of the cumulative update for Outlook Express
  • Update for Windows Media Player URL script command behavior (KB828026)
    • Updated detection to prevent a reoffering.
    • Binaries did not change.
    • Update 828026 does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    828026  (http://support.microsoft.com/kb/828026/ ) Update for Windows Media Player URL script command behavior

Thursday, July 28, 2005

Changes to existing security content

  • MS05-026: A vulnerability in HTML Help could allow remote code execution (KB896358)
    • Metadata was updated. Therefore, superseded updates (MS05-011, MS04-023, and MS03-044) are no longer offered.
    • Binaries did not change.
    • Security update 896358 (MS05-026) does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896358  (http://support.microsoft.com/kb/896358/ ) MS05-026: A vulnerability in HTML Help could allow remote code execution
  • MS03-044: Buffer overrun in Windows Help and Support Center could lead to system compromise (KB825119)
    • Detection was updated to prevent reoffering.
    • Binaries did not change.
    • Security update 825119 (MS03-044) does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    825119  (http://support.microsoft.com/kb/825119/ ) MS03-044: Buffer overrun in Windows Help and Support Center could lead to system compromise

Changes to existing nonsecurity content

  • How to disable the ADODB.Stream object from Internet Explorer (KB870669)

    Microsoft Windows XP
    • Updated so that update 870669 will now be offered to Windows Server Update Services.
    • Binaries did not change.
    • Update 870669 does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    870669  (http://support.microsoft.com/kb/870669/ ) How to disable the ADODB.Stream object from Internet Explorer
  • HTML Help update to limit functionality when it is invoked with the window.showHelp( ) method (KB811630)
    • V6 Classification error. Classification was changed from Update to Critical Update.
    • Binaries did not change.
    • Update 811630 does not have to be reinstalled.
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    811630  (http://support.microsoft.com/kb/811630/ ) HTML Help update to limit functionality when it is invoked with the window.showHelp( ) method

Other minor changes

The following items were updated to take advantage of the WSUS locale filtering feature.
  • Microsoft .NET Framework Service Pack 2

    Affected localized versions: Korean (SDK Applied), Chinese (Simplified) (SDK Applied), English, Italian (SDK Applied), English (SDK Applied), Chinese (Simplified) , Italian , German (SDK Applied), Chinese (Traditional) (SDK Applied), Chinese (Traditional), Japanese (SDK Applied), French (SDK Applied), Korean, Spanish, French, Spanish (SDK Applied), Japanese, German
  • Microsoft Windows SharePoint Services Service Pack 1

    For more information about this service pack, click the following article number to view the article in the Microsoft Knowledge Base:
    841876  (http://support.microsoft.com/kb/841876/ ) Description of Windows SharePoint Services Service Pack 1
    Affected localized versions: Korean, Hungarian, Dutch, Turkish, Swedish, Polish, Hebrew, English, German, Czech, Japanese, Arabic, Chinese (Simplified), Spanish, French, Norwegian, Portuguese (Portugal), Danish, Chinese (Traditional), Greek, Finnish, Russian, Italian, Portuguese (Brazil)
  • Security Update for Microsoft .NET Framework, Version 1.0 SP3

    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    886906  (http://support.microsoft.com/kb/886906/ ) ASP.NET path validation vulnerability in Microsoft .NET Framework 1.0 Service Pack 3
    Localized versions: Italian, Chinese (Traditional), French, Japanese, English, Spanish, German, Korean, Chinese (Simplified)

Removed or expired content

  • Update for Windows XP Media Center Edition 2004 (KB836657)

Tuesday, July 26, 2005

Changes to existing security content

  • MS05-018: Vulnerabilities in Windows kernel could allow elevation of privilege and denial of service (KB890859)
    A minor metadata change was made to resolve a possible Microsoft Systems Management Server (SMS) deployment issue. No changes were made to the binary or to detection. If you have already deployed this update, you do not have to redeploy it. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890859  (http://support.microsoft.com/kb/890859/ ) MS05-018: Vulnerabilities in Windows kernel could allow elevation of privilege and denial of service

Changes to existing nonsecurity critical content

  • Microsoft Windows Server 2003 Service Pack 1

    Targeting has been updated so that it describes the Microsoft Windows Server 2003 Service Pack 1 update as "Installed" and not as "Not Needed."

Tuesday, July 12, 2005

New security content

  • MS05-036: Vulnerability in Microsoft Color Management Module could allow remote code execution (KB901214)

    Bulletin Severity: Critical
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified in the Color Management Module that could allow an attacker to compromise a Microsoft Windows-based system and to gain control over it. You can help protect the computer by installing this update. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    901214  (http://support.microsoft.com/kb/901214/ ) MS05-036: Vulnerability in Microsoft Color Management Module could allow remote code execution
  • MS05-037: Vulnerability in JView Profiler could allow remote code execution (KB903235)

    Bulletin Severity: Critical
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000, Microsoft Windows Millennium Edition, Microsoft Windows 98 Second Edition

    A security issue has been identified that could allow an attacker to compromise a computer that is running Microsoft Internet Explorer and to gain control over it. You can help protect the computer by installing this update. This update sets a registry key that blocks attempts to take advantage of this security issue. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    903235  (http://support.microsoft.com/kb/903235/ ) MS05-037: Vulnerability in JView Profiler could allow remote code execution

Tuesday, June 28, 2005

New update rollup content

Update Rollup 1 for Windows 2000 SP4 and known issues (KB891861)

Microsoft Windows 2000 Service Pack 4

This update consists of previously released recommended, critical and security updates for Windows 2000 that are rolled into one convenient package. When you install this item, you obtain the same results as installing the individual updates. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
891861  (http://support.microsoft.com/kb/891861/ ) Update Rollup 1 for Windows 2000 SP4 and known issues

New nonsecurity critical content

  • A fix is available for a registry problem on Dell PowerEdge servers that have specific nonnative disk controllers and factory installed versions of Windows Server 2003 (KB898792)

    Microsoft Windows Server 2003

    This update fixes possible registry security value corruption on certain Dell PowerEdge servers that are running factory installed versions of Windows Server 2003 and specific disk controller configurations. By installing this update, you automatically verify and, if it is required, permanently repair this registry corruption issue. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    898792  (http://support.microsoft.com/kb/898792/ ) A fix is available for a registry problem on Dell PowerEdge servers that have specific nonnative disk controllers and factory installed versions of Windows Server 2003
  • Software update 898461 installs a permanent copy of the Package Installer for Windows version 6.1.22.4 (KB898461)

    Microsoft Windows XP

    This update installs a permanent copy of Package Installer for Windows to enable software updates to have a significantly smaller download size. The Package Installer makes it easier to install software updates for Microsoft Windows operating systems and other Microsoft products. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    898461  (http://support.microsoft.com/kb/898461/ ) Software update 898461 installs a permanent copy of the Package Installer for Windows version 6.1.22.4
  • You cannot correctly install security fixes in Windows XP Starter Edition (KB898543)

    Microsoft Windows XP Starter Edition

    This update resolves an issue with Windows-based systems that may prevent other software updates from installing correctly. It also resolves an issue that may reduce the maximum displayable screen resolution. This issue only affects computers that use one of the following languages: Brazilian Portuguese, Indonesian, Hindi, Malay, or Thai. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    898543  (http://support.microsoft.com/kb/898543/ ) You cannot correctly install security fixes in Windows XP Starter Edition

New nonsecurity recommended content (unavailable on SUS)

  • Description of the new features in Windows Rights Management Services 1.0 Service Pack 1 (KB839178)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    Rights Management Services (RMS) client Service Pack 1 contains software updates for RMS 1.0 and provides support for self-activating clients and client authentication by using smart cards and X.509 certificates. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    839178  (http://support.microsoft.com/kb/839178/ ) Description of the new features in Windows Rights Management Services 1.0 Service Pack 1
  • Media Pack for Windows XP Home Edition N and Windows XP Professional N (KB886540)

    Windows XP Home Edition N and Windows XP Professional N

    Installation of the Media Pack makes sure that software programs and Web sites that rely on Windows Media Player, as defined by the European Commission, work correctly. After you install this item, you may have to restart the computer. After you have installed this item, it cannot be removed. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    886540  (http://support.microsoft.com/kb/886540/ ) Media Pack for Windows XP Home Edition N and Windows XP Professional N
  • Description of the new features in Windows Rights Management Services 1.0 Service Pack 1 (KB839178)

    Microsoft Windows Server 2003

    Rights Management Services (RMS) Service Pack 1 for Microsoft Windows Server 2003 contains software updates for RMS 1.0 and provides support for the following new features:
    • The ability to enroll the server that is running RMS without server-to-Internet connectivity
    • Server application integration
    • Better support for multiple language templates
    • Support for dynamic groups in the Active Directory directory service
    After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    839178  (http://support.microsoft.com/kb/839178/ ) Description of the new features in Windows Rights Management Services 1.0 Service Pack 1
  • You cannot transfer files and settings from a computer that is running a 32-bit edition of Windows XP to a computer that is running Windows XP Professional x64 Edition (KB896344)

    Microsoft Windows XP

    The Files and Settings Transfer Wizard that is included in Windows XP SP2 does not support gathering data from a 32-bit Windows XP environment and applying it in a 64-bit Windows XP environment. Install this update to enable support for collecting data in a 32-bit Windows XP environment and applying it to a 64-bit Windows XP environment. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896344  (http://support.microsoft.com/kb/896344/ ) You cannot transfer files and settings from a computer that is running a 32-bit edition of Windows XP to a computer that is running Windows XP Professional x64 Edition

Changes to existing security content

Changes are superseded by the Update Rollup and have been removed from the Windows Update site. However, changes will remain available through Software Update Services (SUS), Automatic Updates (AU) and Windows Update (WU) Catalog.


To mark this change for Windows 2000 SP4-only content, we had to touch all previously released security updates that were applicable and create new Windows 2000 SP4-only items. This may require a re-approval of the updates if you do not intend to deploy the Update Rollup.
  • 823182  (http://support.microsoft.com/kb/823182/ ) MS03-041: Vulnerability in authenticode verification could allow remote code execution
  • 823559  (http://support.microsoft.com/kb/823559/ ) MS03-023: Buffer overrun in the HTML converter could allow code execution
  • 824105  (http://support.microsoft.com/kb/824105/ ) MS03-034: Flaw in NetBIOS could lead to information disclosure
  • 824141  (http://support.microsoft.com/kb/824141/ ) MS03-045: Buffer overrun in the ListBox and in the ComboBox Control could allow code execution
  • 824151  (http://support.microsoft.com/kb/824151/ ) MS04-030: Vulnerability in WebDAV XML message handler could lead to a denial of service
  • 825119  (http://support.microsoft.com/kb/825119/ ) MS03-044: Buffer overrun in Windows Help and Support Center could lead to system compromise
  • 826232  (http://support.microsoft.com/kb/826232/ ) MS03-042: Buffer overflow in Windows Troubleshooter ActiveX control could allow code execution
  • 828035  (http://support.microsoft.com/kb/828035/ ) MS03-043: Buffer overrun in Messenger service could allow code execution
  • 828741  (http://support.microsoft.com/kb/828741/ ) MS04-012: Cumulative Update for Microsoft RPC/DCOM
  • 828749  (http://support.microsoft.com/kb/828749/ ) MS03-049: Buffer Overrun in the Workstation Service Could Allow Code Execution
  • 835732  (http://support.microsoft.com/kb/835732/ ) MS04-011: Security Update for Microsoft Windows
  • 837001  (http://support.microsoft.com/kb/837001/ ) MS04-014: Vulnerability in the Microsoft Jet Database Engine could permit code execution
  • 839645  (http://support.microsoft.com/kb/839645/ ) MS04-024: A vulnerability in the Windows shell could allow remote code execution
  • 840315  (http://support.microsoft.com/kb/840315/ ) MS04-023: Vulnerability in HTML Help could allow code execution
  • 840987  (http://support.microsoft.com/kb/840987/ ) MS04-032: Security update for Microsoft Windows
  • 841356  (http://support.microsoft.com/kb/841356/ ) MS04-037: Vulnerability in Windows shell could allow remote code execution
  • 841533  (http://support.microsoft.com/kb/841533/ ) MS04-031: Vulnerability in NetDDE could allow remote code execution
  • 841872  (http://support.microsoft.com/kb/841872/ ) MS04-020: A vulnerability in POSIX could allow code execution
  • 841873  (http://support.microsoft.com/kb/841873/ ) MS04-022: A vulnerability in Task Scheduler could allow code execution
  • 842526  (http://support.microsoft.com/kb/842526/ ) MS04-019: A vulnerability in Utility Manager could allow code execution
  • 870763  (http://support.microsoft.com/kb/870763/ ) MS04-045: Vulnerability in WINS could allow remote code execution
  • 871250  (http://support.microsoft.com/kb/871250/ ) MS05-003: Vulnerability in the Indexing Service could allow remote code execution
  • 873333  (http://support.microsoft.com/kb/873333/ ) MS05-012: Vulnerability in OLE and COM could allow remote code execution
  • 873339  (http://support.microsoft.com/kb/873339/ ) MS04-043: Vulnerability in HyperTerminal could allow code execution
  • 885250  (http://support.microsoft.com/kb/885250/ ) MS05-011: Vulnerability in server message block could allow remote code execution
  • 885834  (http://support.microsoft.com/kb/885834/ ) MS05-010: Vulnerability in the License Logging service could allow code execution
  • 885835  (http://support.microsoft.com/kb/885835/ ) MS04-044: Vulnerabilities in Windows Kernel and LSASS could allow elevation of privilege
  • 885836  (http://support.microsoft.com/kb/885836/ ) MS04-041: A vulnerability in WordPad could allow code execution
  • 888113  (http://support.microsoft.com/kb/888113/ ) MS05-015: Vulnerability in hyperlink object library could allow remote code execution in Windows Server 2003
  • 890047  (http://support.microsoft.com/kb/890047/ ) MS05-008: Vulnerability in Windows shell could allow remote code execution
  • 890175  (http://support.microsoft.com/kb/890175/ ) MS05-001: Vulnerability in HTML Help could allow code execution
  • 890859  (http://support.microsoft.com/kb/890859/ ) MS05-018: Vulnerabilities in Windows kernel could allow elevation of privilege and denial of service
  • 891711  (http://support.microsoft.com/kb/891711/ ) MS05-002: Vulnerability in cursor and icon format handling could allow remote code execution
  • 891781  (http://support.microsoft.com/kb/891781/ ) MS05-013: Vulnerability in the DHTML editing component ActiveX control could allow code execution
  • 892944  (http://support.microsoft.com/kb/892944/ ) MS05-017: Vulnerability in MSMQ could allow code execution
  • 893066  (http://support.microsoft.com/kb/893066/ ) MS05-019: Vulnerabilities in TCP/IP could allow remote code execution and denial of service
  • 893086  (http://support.microsoft.com/kb/893086/ ) MS05-016: Vulnerability in Windows Shell that could allow remote code execution
  • 839643  (http://support.microsoft.com/kb/839643/ ) MS04-016: Vulnerability in DirectPlay could allow denial of service
  • 814078  (http://support.microsoft.com/kb/814078/ ) MS03-008: Flaw in Windows Script Engine may allow code to run
  • 822343  (http://support.microsoft.com/kb/822343/ ) MS03-022: Vulnerability in ISAPI Extension for Windows Media Services may cause code execution
  • 890923  (http://support.microsoft.com/kb/890923/ ) MS05-020: Cumulative security update for Internet Explorer

Changes to existing nonsecurity updates

Changes are superseded by the update rollup and are removed from the Windows Update site. However, changes will remain available by using Software Update Services (SUS), Automatic Updates (AU), and the Windows Update Catalog.


To be able to mark this change for Windows 2000 SP4-only content, we had to touch all previously released updates that were applicable and create new Windows 2000 SP4-only items. This may require a re-approval of the updates if you do not intend to deploy the update rollup.
  • 820888  (http://support.microsoft.com/kb/820888/ ) Computer stops responding (hangs) when it tries to mount an NTFS volume after you restart the computer

Tuesday, June 14, 2005

New security content

  • MS05-025: Cumulative security update for Internet Explorer (KB883939)

    Bulletin Severity: Critical
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000, Microsoft Windows Millennium Edition, Microsoft Windows 98 Second Edition

    Security issues have been identified that could allow an attacker to compromise a computer that is running Microsoft Internet Explorer and to gain control over the computer. You can help protect a computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    883939  (http://support.microsoft.com/kb/883939/ ) MS05-025: Cumulative security update for Internet Explorer
  • MS05-026: Vulnerability in HTML Help could allow remote code execution (KB896358)

    Bulletin Severity: Critical
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000, Microsoft Windows Millennium Edition, Microsoft Windows 98 Second Edition

    A security issue has been identified in the HTML Help component that could allow an attacker to compromise a Windows-based system and to gain control over the system. You can help protect a computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896358  (http://support.microsoft.com/kb/896358/ ) MS05-026: A vulnerability in HTML Help could allow remote code execution
  • MS05-027: Vulnerability in server message block could allow remote code execution (KB896422)

    Bulletin Severity: Critical
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified in server message block that could allow an attacker to compromise a Windows-based system and to gain control over the system. You can help protect a computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896422  (http://support.microsoft.com/kb/896422/ ) MS05-027: Vulnerability in Server Message Block could allow remote code execution
  • MS05-028: A vulnerability in the Web Client Service could allow remote code execution (KB896426)

    Bulletin Severity: Important
    Microsoft Windows Server 2003, Microsoft Windows XP

    A security issue has been identified in the Web Client service that could allow an attacker to compromise a Windows-based system and to gain control over the system. You can help protect a computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896426  (http://support.microsoft.com/kb/896426/ ) MS05-028: A vulnerability in the Web Client Service could allow remote code execution
  • MS05-030: Vulnerability in Outlook Express could allow remote code execution (KB897715)

    Bulletin Severity: Important
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified that could allow an attacker to compromise a computer that is running Microsoft Outlook Express and to gain control over the computer. User interaction is required to exploit this vulnerability. You can help protect a computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    897715  (http://support.microsoft.com/kb/897715/ ) MS05-030: Vulnerability in Outlook Express could allow remote code execution
  • MS05-031: Vulnerability in step-by-step interactive training could allow remote code execution (KB898458)

    Bulletin Severity: Important
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified in the Step-by-Step Interactive Training program that could allow an attacker to compromise a Microsoft Windows-based system and to gain control over the system. You can help protect a computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    898458  (http://support.microsoft.com/kb/898458/ ) MS05-031: Vulnerability in step-by-step interactive training could allow remote code execution
  • MS05-032: Vulnerability in Microsoft agent could allow spoofing (KB890046)

    Bulletin Severity: Moderate
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified in Microsoft Agent that could allow an attacker to compromise a Windows-based system and to gain control over the system. You can help protect a computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890046  (http://support.microsoft.com/kb/890046/ ) MS05-032: Vulnerability in Microsoft agent could allow spoofing
  • MS05-033: Vulnerability in Telnet client could allow information disclosure (KB896428)

    Bulletin Severity: Moderate
    Microsoft Windows Server 2003, Microsoft Windows XP

    A security issue in Telnet has been identified that could allow an attacker to learn information about a Windows-based system. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    896428  (http://support.microsoft.com/kb/896428/ ) MS05-033: Vulnerability in Telnet client could allow information disclosure

Changes to existing security content

New binaries
  • ASP.NET path validation vulnerability in Microsoft .NET Framework 1.0 Service Pack 3 on Windows XP Media Center and Tablet PC Editions (KB887998)

    Microsoft Windows XP Tablet PC Edition, Microsoft Windows XP Media Center Edition

    A security issue has been identified that could allow an attacker to compromise a Windows-based system that is running the Microsoft .NET Framework and to gain access to restricted data. You can help protect a computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    887998  (http://support.microsoft.com/kb/887998/ ) ASP.NET path validation vulnerability in Microsoft .NET Framework 1.0 Service Pack 3 on Windows XP Media Center and Tablet PC Editions
  • MS05-019: Vulnerabilities in TCP/IP could allow remote code execution and denial of service (KB893066)

    Bulletin Severity: Critical
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified that could allow an attacker to remotely compromise a Windows-based system and to gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    893066  (http://support.microsoft.com/kb/893066/ ) MS05-019: Vulnerabilities in TCP/IP could allow remote code execution and denial of service
Updated for supersession
  • 890923  (http://support.microsoft.com/kb/890923/ ) MS05-020: Cumulative security update for Internet Explorer
  • 817606  (http://support.microsoft.com/kb/817606/ ) MS03-024: Buffer overrun in Windows could lead to data corruption
  • 823353  (http://support.microsoft.com/kb/823353/ ) MS04-018: Cumulative security update for Outlook Express
  • 825119  (http://support.microsoft.com/kb/825119/ ) MS03-044: Buffer overrun in Windows Help and Support Center could lead to system compromise
  • 840315  (http://support.microsoft.com/kb/840315/ ) MS04-023: Vulnerability in HTML Help could allow code execution
  • 890175  (http://support.microsoft.com/kb/890175/ ) MS05-001: Vulnerability in HTML Help could allow code execution
Metadata or detection changes
  • MS03-022: Vulnerability in ISAPI Extension for Windows Media Services may cause code execution (KB822343)

    This update includes minor detection changes to prevent this item from being offered when Media Service is not installed. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    822343  (http://support.microsoft.com/kb/822343/ ) MS03-022: Vulnerability in ISAPI Extension for Windows Media Services may cause code execution

New nonsecurity critical content

  • An update for Windows Installer 3.1 is available for Windows Server 2003 S898715 and for the 64-bit editions of Windows XP (KB898715)

    Portuguese (Brazil) and Spanish only
    Microsoft Windows Server 2003

    This update addresses compatibility issues with Microsoft Windows Installer 3.1 and with certain programs. These issues are described in Microsoft Knowledge Base article 898715. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    898715  (http://support.microsoft.com/kb/898715/ ) An update for Windows Installer 3.1 is available for Windows Server 2003 Service Pack 1 and for the 64-bit editions of Windows XP
  • Windows Installer 3.1 (v2) is available (KB893803)

    Japanese-NEC only
    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    Windows Installer 3.1 is the program installation and configuration service for Windows. The additional features in version 3.1 help make creating, distributing, and managing updates to programs easier and more efficient. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    893803  (http://support.microsoft.com/kb/893803/ ) Windows Installer 3.1 v2 (3.1.4000.2435) is available

Changes to existing nonsecurity critical content

Updated for supersession
  • 887797  (http://support.microsoft.com/kb/887797/ ) Description of the cumulative update for Outlook Express
Metadata or detection changes
  • 870669  (http://support.microsoft.com/kb/870669/ ) How to disable the ADODB.Stream object from Internet Explorer
    This item is now marked for Windows Server Update Services (WSUS).

New nonsecurity recommended content

  • Root Certificates Update
    Microsoft Windows 2000 Service Pack 3, Microsoft Windows 2000 Service Pack 4

    This item updates the list of root certificates on a computer to the latest list that is accepted by Microsoft as part of the Microsoft Root Certificate Program. Adding additional root certificates to a computer lets a greater range of security-enhanced Web browsing, secure e-mail, and secure code delivery programs work together seamlessly. This update includes root certificates from Verisign, Thawte, and Post.Trust in Ireland.

Tuesday, May 24, 2005

New nonsecurity critical content

Software Update Services (SUS) 1.0
  • Microsoft Windows Server 2003 Service Pack 1
    Locales released to date: Portuguese and Hungarian (released on May 24, 2005), Dutch, Swedish, Czech, Polish, Turkish (released on May 10, 2005), Chinese Traditional, Chinese Simplified, Portuguese Brazilian, Russian (released on April 26, 2005), Spanish, Italian and Korean (released on April 21, 2005), French and Japanese (released on April 18, 2005), English and German (released on March 28, 2005)

    Microsoft Windows Server 2003, Enterprise Edition; Microsoft Windows Server 2003, Standard Edition; Microsoft Windows Server 2003, Web Edition

    Windows Server 2003 Service Pack 1 (SP1) enhances manageability, control, and security infrastructure by providing new security tools, such as the Security Configuration Wizard. These tools help secure a server for role-based operations. Windows Server 2003 SP1 improves defense-in-depth (precautionary defensive measures) by using Data Execution Protection and helps provide a safe and secure first-boot scenario by using the Post-setup Security Update Wizard.
Windows Update (WU) Consumer and Catalog sites
  • Windows Server 2003 Service Pack 1
    Locales released to date: Portuguese and Hungarian (released May 24, 2005), Dutch, Swedish, Czech, Polish, Turkish (released on May 10, 2005), Chinese Traditional, Chinese Simplified, Chinese Hong-Kong (catalog only), Portuguese Brazilian, Russian (released on April 26, 2005), French, Italian, Spanish, Japanese, and Korean (released on April 18, 2005), English and German (released on March 28, 2005)

    Microsoft Windows Server 2003, Enterprise Edition; Microsoft Windows Server 2003, Standard Edition; Microsoft Windows Server 2003, Web Edition

    Windows Server 2003 Service Pack 1 (SP1) enhances manageability, control, and security infrastructure by providing new security tools, such as the Security Configuration Wizard. These tools help secure a server for role-based operations. Windows Server 2003 SP1 improves defense-in-depth by using Data Execution Protection and helps provide a safe and secure first-boot scenario by using the Post-setup Security Update Wizard.

Changes to existing security content

  • MS05-002: Vulnerability in cursor and icon format handling could allow remote code execution (KB891711)

    Microsoft Windows Millennium Edition

    A security issue has been identified that could allow an attacker to compromise an affected system and to gain control over it. You can help protect the computer by installing this update from Microsoft. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    891711  (http://support.microsoft.com/kb/891711/ ) MS05-002: Vulnerability in cursor and icon format handling could allow remote code execution

Tuesday, May 17, 2005

New nonsecurity critical content

Software Update Services (SUS) 1.0 and Windows Update (WU) Catalog
  • An update for Windows Installer 3.1 is available for Windows Server 2003 S898715 and for the 64-bit editions of Windows XP (KB898715)

    Microsoft Windows Server 2003 Service Pack 1

    This update addresses application compatibility issues with Windows Installer 3.1 and with certain applications as described in Knowledge Base article 898715. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    898715  (http://support.microsoft.com/kb/898715/ ) An update for Windows Installer 3.1 is available for Windows Server 2003 Service Pack 1 and for the 64-bit editions of Windows XP

Changes to existing nonsecurity updates

SUS 1.0, Windows Update (WU) Catalog Consumer, Catalog, and AutoUpdate
  • Windows Installer 3.1 (v2) is available (KB893803)

    Microsoft Windows 2000 Service Pack 3, Microsoft Windows 2000 Service Pack 4, the original release version of Microsoft Windows Server 2003, the original release version of Microsoft Windows Server 2003 Datacenter Edition, Microsoft Windows XP Service Pack 1, Microsoft Windows XP Service Pack 2

    The Microsoft Windows Installer 3.1 is the application installation and configuration service for Windows. The additional features in version 3.1 help make creating, distributing, and managing updates to applications easier and more efficient. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    893803  (http://support.microsoft.com/kb/893803/ ) Windows Installer 3.1 v2 (3.1.4000.2435) is available

Tuesday, May 10, 2005

New security updates

  • MS05-024: Vulnerability in Web View could allow remote code execution (KB894320)

    Microsoft Windows 2000 Service Pack 3, Microsoft Windows 2000 Service Pack 4

    A security issue has been identified that could allow an attacker to remotely compromise a Windows-based computer and to gain control over the computer. You can help protect the computer by installing this update from Microsoft. After you install this item, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    894320  (http://support.microsoft.com/kb/894320/ ) MS05-024: Vulnerability in Web View could allow remote code execution

New nonsecurity critical content

Software Update Services (SUS) 1.0
  • Microsoft Windows Server 2003 Service Pack 1
    Locales released to date: Dutch, Swedish, Czech, Polish, and Turkish (released on May 10, 2005), Chinese Traditional, Chinese Simplified, Portuguese Brazilian, and Russian (released on April 26, 2005), Spanish, Italian, and Korean (released on April 21, 2005), French and Japanese (released on April 18, 2005), English and German (released on March 28, 2005)

    Microsoft Windows Server 2003, Enterprise Edition; Microsoft Windows Server 2003, Standard Edition; Microsoft Windows Server 2003, Web Edition

    Windows Server 2003 Service Pack 1 (SP1) enhances manageability, control, and security infrastructure by providing new security tools, such as Security Configuration Wizard. These tools help secure a server for role-based operations. Windows Server 2003 SP1 improves defense-in-depth by using Data Execution Protection and helps provide a safe and secure first-boot scenario by using Post-setup Security Update Wizard.
Windows Update (WU) Consumer and Catalog sites
  • Windows Server 2003 Service Pack 1
    Locales released to date: Dutch, Swedish, Czech, Polish, Turkish (released on May 10, 2005), Chinese Traditional, Chinese Simplified, Chinese Hong-Kong (catalog only), Portuguese Brazilian, Russian (released on April 26, 2005), French, Italian, Spanish, Japanese, and Korean (released on April 18, 2005), English and German (released on March 28, 2005)

    Microsoft Windows Server 2003, Enterprise Edition; Microsoft Windows Server 2003, Standard Edition; Microsoft Windows Server 2003, Web Edition

    Windows Server 2003 Service Pack 1 (SP1) enhances manageability, control, and security infrastructure by providing new security tools, such as Security Configuration Wizard, that help secure a server for role-based operations. Windows Server 2003 SP1 improves defense-in-depth by using Data Execution Protection and helps provide a safe and secure first-boot scenario by using Post-setup Security Update Wizard.

Tuesday, May 3, 2005

Changes to existing nonsecurity updates

Content removal
  • Windows Installer 3.1 (v2) is available (KB893803)
    Microsoft Windows 2000 Service Pack 3; Microsoft Windows 2000 Service Pack 4; the original release version of Microsoft Windows Server 2003; the original release version of Microsoft Windows Server 2003, Datacenter Edition; Microsoft Windows XP Service Pack 1; Microsoft Windows XP Service Pack 2

    The Windows Installer 3.1 update has been removed because of unexpected compatibility issues with specific software applications. For more information, see the following articles in the Microsoft Knowledge Base:
    893803  (http://support.microsoft.com/kb/893803/ ) Windows Installer 3.1 v2 (3.1.4000.2435) is available
    898628  (http://support.microsoft.com/kb/898628/ ) Windows Installer fails silently after you upgrade to Windows Installer 3.1

Tuesday, April 26, 2005

New nonsecurity critical content

Software Update Services (SUS) 1.0
  • Microsoft Windows Server 2003 Service Pack 1
    Locales released to date: Chinese Traditional, Chinese Simplified, Portuguese, Brazilian, Russian (released April 26, 2005), Spanish, Italian, Korean (released April 21, 2005), French, Japanese (released April 18, 2005), English, German (released March 28, 2005)

    Microsoft Windows Server 2003, Enterprise Edition; Microsoft Windows Server 2003, Standard Edition; Microsoft Windows Server 2003, Web Edition

    Republishing all locales to implement update to detection

    Windows Server 2003 Service Pack 1 (SP1) enhances manageability, control, and security infrastructure by providing new security tools, such as Security Configuration Wizard. Security Configuration Wizard helps secure a server for role-based operations. Windows Server 2003 SP1 improves defense-in-depth by using Data Execution Protection. Windows Server 2003 SP1 also helps provide a safe and secure first-boot scenario by using Post-setup Security Update Wizard.
Windows Update (WU) Consumer and Catalog sites
  • Microsoft Windows Server 2003 Service Pack 1
    Locales released to date: Chinese Traditional, Chinese Simplified, Chinese Hong-Kong (catalog only), Portuguese, Brazilian, Russian (released April 26, 2005), French, Italian, Spanish, Japanese, and Korean (released April, 18, 2005), English and German (released March 28, 2005)
    Microsoft Windows Server 2003, Enterprise Edition, Microsoft Windows Server 2003, Standard Edition, Microsoft Windows Server 2003, Web Edition

    Republishing all locales to implement update to detection

    Windows Server 2003 Service Pack 1 (SP1) enhances manageability, control, and security infrastructure by providing new security tools such as Security Configuration Wizard. Security Configuration Wizard helps secure a server for role-based operations. Windows Server 2003 SP1 improves defense-in-depth by using Data Execution Protection. Windows Server 2003 SP1 also helps provide a safe and secure first-boot scenario by using Post-setup Security Update Wizard.

Changes to existing security updates

Metadata/behavior change
  • MS05-003: Vulnerability in the Indexing Service could allow remote code execution (KB871250)

    (This change applies only to the Dutch locale. It is a site-only issue. It does not affect SUS or WSUS.)

    Microsoft Windows Server 2003

    The Dutch express package installation command contained a typographic error that prevented the package from installing. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    871250  (http://support.microsoft.com/kb/871250/ ) MS05-003: Vulnerability in the Indexing Service could allow remote code execution
  • MS03-045: Buffer overrun in the ListBox and in the ComboBox Control could allow code execution (KB824141)

    Microsoft Windows Server 2003

    Legacy targeting had to be changed to prevent this update from being offered to Windows Server 2003 SP1 users. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    824141  (http://support.microsoft.com/kb/824141/ ) MS03-045: Buffer overrun in the ListBox and in the ComboBox Control could allow code execution
  • HTML Help update to limit functionality when it is invoked with the window.showHelp( ) method (KB811630)

    Microsoft Windows 2000 Service Pack 2, Microsoft Windows 2000 Service Pack 3

    Corrected Windows Update (WU) catalog classification. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    811630  (http://support.microsoft.com/kb/811630/ ) HTML Help update to limit functionality when it is invoked with the window.showHelp( ) method

Changes to existing nonsecurity updates

Minor software update
  • Recommended update for DirectX 9.0 - Managed DirectX
    Minor text changes and binary updates to prevent dialog boxes from appearing.

Monday, April 18, 2005

New nonsecurity critical content

Software Update Services (SUS) 1.0
  • Microsoft Windows Server 2003 Service Pack 1
    Locales released to date: French, Japanese (released on April 18, 2005), English, German (released on March 28, 2005), Spanish, Italian, Korean (will release on April 21, 2005)
    Windows Server 2003, Enterprise Edition; Windows Server 2003, Standard Edition; Windows Server 2003, Web Edition

    Windows Server 2003 Service Pack 1 (SP1) enhances manageability, control, and security infrastructure by providing new security tools such as the Security Configuration Wizard. Security Configuration Wizard helps secure a server for role-based operations. Windows Server 2003 SP1 improves defense-in-depth by using Data Execution Protection. Windows Server 2003 SP1 also helps provide a safe and secure first-boot scenario by using the Post-setup Security Update Wizard.
Windows Update (WU) Consumer and Catalog sites
  • Windows Server 2003 Service Pack 1
    Locales released to date: French, Italian, Spanish, Japanese and Korean (released on April 18, 2005), English, German (released March 28, 2005)
    Windows Server 2003, Enterprise Edition; Windows Server 2003, Standard Edition; Windows Server 2003, Web Edition

    Windows Server 2003 Service Pack 1 (SP1) enhances manageability, control, and security infrastructure by providing new security tools such as the Security Configuration Wizard. The Security Configuration Wizard helps secure a server for role-based operations. Windows Server 2003 SP1 improves defense-in-depth by using Data Execution Protection. Windows Server 2003 SP1 also helps provide a safe and secure first-boot scenario by using the Post-setup Security Update Wizard.

Expired updates

These items have previously been removed from the site and are now expiring on Software Update Services (SUS).

Internet Explorer cumulative updates
  • 828750  (http://support.microsoft.com/kb/828750/ ) MS03-040: October, 2003, Cumulative Patch for Internet Explorer
  • 824145  (http://support.microsoft.com/kb/824145/ ) MS03-048: November 2003 Cumulative Security Update for Internet Explorer
  • 832894  (http://support.microsoft.com/kb/832894/ ) MS04-004: Cumulative Security Update for Internet Explorer
  • 834707  (http://support.microsoft.com/kb/834707/ ) MS04-038: Cumulative Security Update for Internet Explorer

Tuesday, April 12, 2005

New security updates

  • MS05-016: Vulnerability in Windows Shell that could allow remote code execution (KB893086)

    Microsoft Windows 2000 Service Pack 3, Microsoft Windows 2000 Service Pack 4, the original release version of Microsoft Windows Server 2003, the original release version of Microsoft Windows Server 2003, Datacenter Edition, Microsoft Windows XP Service Pack 1, Microsoft Windows XP Service Pack 2, Microsoft Windows Server 2003, Datacenter Edition for 64-bit Itanium-based Systems, Microsoft Windows Server 2003, Enterprise Edition for 64-bit Itanium-based Systems, Microsoft Windows XP Professional 64-Bit Edition (Itanium) 2003

    A security issue has been identified that could allow an attacker to remotely compromise a Windows-based computer and to gain control over it. You can help protect the computer by installing this update from Microsoft. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    893086  (http://support.microsoft.com/kb/893086/ ) MS05-016: Vulnerability in Windows Shell that could allow remote code execution
  • MS05-017: Vulnerability in MSMQ could allow code execution (KB892944)

    Microsoft Windows 2000 Service Pack 3, Microsoft Windows 2000 Service Pack 4, Microsoft Windows XP 64-Bit Edition Service Pack 1, Microsoft Windows XP Professional Service Pack 1

    A security issue has been identified in Microsoft Message Queuing (MSMQ) that could allow an attacker to compromise a Windows-based computer and to gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    892944  (http://support.microsoft.com/kb/892944/ ) MS05-017: Vulnerability in MSMQ could allow code execution
  • MS05-018: Vulnerabilities in Windows kernel could allow elevation of privilege and denial of service (KB890859)

    Microsoft Windows 2000 Service Pack 3, Microsoft Windows 2000 Service Pack 4, Microsoft Windows Server 2003, Microsoft Windows Server 2003, Datacenter Edition, Microsoft Windows XP Service Pack 1, Microsoft Windows XP Service Pack 2, Microsoft Windows Server 2003, Datacenter Edition for 64-bit Itanium-based Systems, Microsoft Windows Server 2003, Enterprise Edition for 64-bit Itanium-based Systems, Microsoft Windows XP Professional 64-Bit Edition (Itanium) 2003

    A security issue has been identified that could allow an attacker to remotely compromise a Windows-based computer and to gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890859  (http://support.microsoft.com/kb/890859/ ) MS05-018: Vulnerabilities in Windows kernel could allow elevation of privilege and denial of service
  • MS05-019: Vulnerabilities in TCP/IP could allow remote code execution and denial of service (KB893066)

    Microsoft Windows 2000 Service Pack 3, Microsoft Windows 2000 Service Pack 4, Microsoft Windows Server 2003, Microsoft Windows Server 2003, Datacenter Edition, Microsoft Windows XP Service Pack 1, Microsoft Windows XP Service Pack 2, Microsoft Windows Server 2003, Datacenter Edition for 64-bit Itanium-based Systems, Microsoft Windows Server 2003, Enterprise Edition for 64-bit Itanium-based Systems, Microsoft Windows XP Professional 64-Bit Edition (Itanium) 2003

    A security issue has been identified that could allow an attacker to remotely compromise a Windows-based computer and to gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    893066  (http://support.microsoft.com/kb/893066/ ) MS05-019: Vulnerabilities in TCP/IP could allow remote code execution and denial of service
  • MS05-020: Cumulative Security Update for Internet Explorer (KB890923)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000, Microsoft Windows Millennium Edition, Microsoft Windows 98 Second Edition

    A security issue has been identified that could allow an attacker to compromise a computer that is running Microsoft Internet Explorer and to gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890923  (http://support.microsoft.com/kb/890923/ ) MS05-020: Cumulative security update for Internet Explorer

New nonsecurity critical content

  • An update package that includes BITS 2.0 and WinHTTP 5.1 is available for Windows Server 2003, for Windows XP, and for Windows 2000 (KB842773)

    Microsoft Windows 2000 Service Pack 3; Microsoft Windows 2000 Service Pack 4; Microsoft Windows Server 2003; Microsoft Windows Server 2003, Datacenter Edition

    This software updates the Background Intelligent Transfer Service (BITS) to version 2.0 and updates WinHTTP. These updates help make sure an optimal download experience. The updates use new versions of Automatic Updates, Windows Update, and other programs that rely on BITS to transfer files by using idle network bandwidth. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    842773  (http://support.microsoft.com/kb/842773/ ) An update package that includes BITS 2.0 and WinHTTP 5.1 is available for Windows Server 2003, for Windows XP, and for Windows 2000
  • Windows Installer 3.1 (v2) is available (KB893803)

    Microsoft Windows 2000 Service Pack 3;Microsoft Windows 2000 Service Pack 4; Microsoft Windows Server 2003; Microsoft Windows Server 2003, Datacenter Edition; Microsoft Windows XP Service Pack 1; Microsoft Windows XP Service Pack 2

    Microsoft Windows Installer 3.1 is the application installation and configuration service for Windows. The additional features in version 3.1 help make creating, distributing, and managing updates to applications easier and more efficient. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    893803  (http://support.microsoft.com/kb/893803/ ) Windows Installer 3.1 v2 (3.1.4000.2435) is available
  • Windows Server 2003 Service Pack 1
    Locales released to date: English, German (shipped on March 28, 2005), Japanese, Korean, French, Spanish, Italian (will ship on April 18, 2005 to SUS).
    Microsoft Windows Server 2003, Enterprise Edition; Microsoft Windows Server 2003, Standard Edition; Microsoft Windows Server 2003, Web Edition

    Windows Server 2003 Service Pack 1 (SP1) enhances manageability, control, and security infrastructure by providing new security tools such as Security Configuration Wizard. This wizard helps secure a server for role-based operations. Windows Server 2003 SP1 improves defense-in-depth by using Data Execution Protection. Additionally, Windows Server 2003 SP1 provides a safe and secure first-boot scenario by using Post-setup Security Update Wizard. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
  • The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000 (KB890830)

    Microsoft Windows XP

    After you download the Malicious Software Removal Tool, the tool runs one time to examine the computer for infection by specific, prevalent malicious software. (This software includes Blaster, Sasser, and Mydoom.) The tool automatically helps remove any variants found. After the tool runs, the tool is deleted from the computer. A new version of the tool is offered every month. If you want to manually run the tool on a computer, you can download a copy from the Microsoft Download Center, or you can run an online version from Microsoft.com. Besides using this tool, you should use an up-to-date antivirus product to help protect a computer from other malicious software. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890830  (http://support.microsoft.com/kb/890830/ ) The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000

Changes to existing security content

New binaries:
  • MS05-009: Microsoft has released a security update to Microsoft Windows Messenger (KB887472)

    Microsoft Windows XP SP1

    This update will be offered to v4.7.0.2009 users. The update changes prerequisite detection for the current live item from 4.7.0.2009 to 4.7.0.0041 for the Msmsgs.exe file. The original item was shipped to only update v4.7.0.2009 users. This is a rerelease of the same item. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    887472  (http://support.microsoft.com/kb/887472/ ) MS05-009: Microsoft has released a security update to Microsoft Windows Messenger
  • MS05-002: Vulnerability in cursor and icon format handling could allow remote code execution (KB891711)

    Microsoft Windows 98, Microsoft Windows Millennium Edition

    A security issue has been identified that could allow an attacker to compromise a Windows-based computer and to gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    891711  (http://support.microsoft.com/kb/891711/ ) MS05-002: Vulnerability in cursor and icon format handling could allow remote code execution
Updated for supersession:
  • 890047  (http://support.microsoft.com/kb/890047/ ) MS05-008: Vulnerability in Windows shell could allow remote code execution
  • 867282  (http://support.microsoft.com/kb/867282/ ) MS05-014: Cumulative security update for Internet Explorer
  • 891711  (http://support.microsoft.com/kb/891711/ ) MS05-002: Vulnerability in cursor and icon format handling could allow remote code execution
    Microsoft Windows 2000 | Microsoft Windows XP

Expired security updates

These items have previously been removed from the site and are now expiring on SUS. This is per the agreement to keep content on SUS for one additional year.
  • 811493  (http://support.microsoft.com/kb/811493/ ) MS03-013: Buffer overrun in Windows kernel message handling could lead to elevated privileges
    Note This item is removed for Windows XP only in Windows Update Services (WUS). It is not a Software Update Services (SUS) 1.0-related issue.

Tuesday, March 8, 2005

New security updates

There are no new security updates for this release.

New nonsecurity critical updates

There are no new nonsecurity updates for this release.

Changes to existing security updates

Targeting changes:


The operating systems on the identified items have been changed from "Windows Server 2003 Family" to "Windows Server 2003 RTM." The goal is to prevent the identified items from being offered to Windows Server 2003 Service Pack 1 (SP1) users.
839643  (http://support.microsoft.com/kb/839643/ ) MS04-016: Vulnerability in DirectPlay could allow denial of service
823353  (http://support.microsoft.com/kb/823353/ ) MS04-018: Cumulative security update for Outlook Express
832483  (http://support.microsoft.com/kb/832483/ ) MS04-003: Buffer overrun in an MDAC function could allow code execution
819696  (http://support.microsoft.com/kb/819696/ ) MS03-030: Unchecked Buffer in DirectX could enable system compromise
823182  (http://support.microsoft.com/kb/823182/ ) MS03-041: Vulnerability in Authenticode verification could allow remote code execution
823559  (http://support.microsoft.com/kb/823559/ ) MS03-023: Buffer overrun in the HTML converter could allow code execution
824105  (http://support.microsoft.com/kb/824105/ ) MS03-034: Flaw in NetBIOS could lead to information disclosure
825119  (http://support.microsoft.com/kb/825119/ ) MS03-044: Buffer overrun in Windows Help and Support Center could lead to system compromise
828035  (http://support.microsoft.com/kb/828035/ ) MS03-043: Buffer overrun in Messenger service could allow code execution
828741  (http://support.microsoft.com/kb/828741/ ) MS04-012: Cumulative update for Microsoft RPC/DCOM
833987  (http://support.microsoft.com/kb/833987/ ) MS04-028: Buffer overrun in JPEG processing (GDI+) could allow code execution
835732  (http://support.microsoft.com/kb/835732/ ) MS04-011: Security Update for Microsoft Windows
837001  (http://support.microsoft.com/kb/837001/ ) MS04-014: Vulnerability in the Microsoft Jet Database Engine could permit code execution
839645  (http://support.microsoft.com/kb/839645/ ) MS04-024: A vulnerability in the Windows shell could allow remote code execution
840315  (http://support.microsoft.com/kb/840315/ ) MS04-023: Vulnerability in HTML Help could allow code execution
819639  (http://support.microsoft.com/kb/819639/ ) MS03-021: A flaw in Windows Media Player may permit the Media Library to be accessed
840374  (http://support.microsoft.com/kb/840374/ ) MS04-015 Security Update for Microsoft Windows
Detection change:

824105  (http://support.microsoft.com/kb/824105/ ) MS03-034: Flaw in NetBIOS could lead to information disclosure
There was a minor change to detection to prevent possible reoffering.

Changes to existing nonsecurity critical updates

Targeting changes:
The operating systems on the identified items have changed from "Windows Server 2003 Family" to "Windows Server 2003 RTM" on version 4. The goal is to prevent the identified items from being offered by the v4 catalog and consumer site to Windows Server 2003 Service Pack 1 (SP1) users.
872769  (http://support.microsoft.com/kb/872769/ ) You cannot configure Windows Firewall settings or Security Center settings on a Windows XP Service Pack 2-based client computer that is in a Windows Small Business Server 2003-based network
870669  (http://support.microsoft.com/kb/870669/ ) How to disable the ADODB.Stream object from Internet Explorer
837272  (http://support.microsoft.com/kb/837272/ ) The time to copy increases as the number of items in the Media Library increases for Windows Media Player 9 Series
843496  (http://support.microsoft.com/kb/843496/ ) Description of Windows Media Services 9 Series software update package: July 13, 2004
828026  (http://support.microsoft.com/kb/828026/ ) Update for Windows Media Player URL script command behavior

Expired security updates

The following items have previously been removed from the site and are now expiring on SUS. This is per the agreement to keep content on SUS for one additional year.
324380  (http://support.microsoft.com/kb/324380/ ) MS02-051: Cryptographic flaw in RDP can cause information disclosure
328310  (http://support.microsoft.com/kb/328310/ ) MS02-071: Flaw in Windows WM_TIMER message handling can enable privilege elevation
330994  (http://support.microsoft.com/kb/330994/ ) MS03-014: April 2003 cumulative patch for Outlook Express
811493  (http://support.microsoft.com/kb/811493/ ) MS03-013: Buffer overrun in Windows kernel message handling could lead to elevated privileges
822679  (http://support.microsoft.com/kb/822679/ ) MS03-025: Flaw in Windows message handling through Utility Manager could enable privilege elevation
824146  (http://support.microsoft.com/kb/824146/ ) MS03-039: A buffer overrun in RPCSS could allow an attacker to run malicious programs
828028  (http://support.microsoft.com/kb/828028/ ) MS04-007: An ASN.1 vulnerability could allow code execution

Tuesday, February 22, 2005

New security updates

There are no new security updates for this release.

New nonsecurity critical updates

  • Double-byte character set (DBCS) characters may appear corrupted in Internet Explorer on Windows XP when you browse a Web site that uses Shift-JIS character encoding (KB886677)

    Microsoft Windows XP Service Pack 2 (SP2) (Japanese, Korean, Chinese [Traditional], Chinese [Simplified] only)

    This update addresses an issue where double-byte character set (DBCS) characters may appear corrupted in Microsoft Internet Explorer on a Windows XP-based computer. This issue occurs when you browse a Web site that uses Shift-JIS character encoding. Install this update to help resolve this issue. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    886677  (http://support.microsoft.com/kb/886677/ ) Double-byte character set (DBCS) characters may appear corrupted in Internet Explorer on Windows XP when you browse a Web site that uses Shift-JIS character encoding
  • You receive the Stop error "Stop 0x05 (INVALID_PROCESS_ATTACH_ATTEMPT)" in Windows XP Service Pack 2 or Windows Server 2003 (KB887742)

    Windows XP SP2 (all languages)

    This update addresses an issue that could cause a computer to stop responding if certain firewall or antivirus programs are installed. You can help resolve this issue by installing this HTTP.sys update from Microsoft. After you install this update, you may have to restart the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    887742  (http://support.microsoft.com/kb/887742/ ) You receive the Stop error "Stop 0x05 (INVALID_PROCESS_ATTACH_ATTEMPT)" in Windows XP Service Pack 2 or Windows Server 2003
  • Update package that includes Background Intelligent Transfer Service (BITS) version 2.0 and WinHTTP 5.1 is available for Windows XP (KB842773)

    Microsoft Windows 2000 Service Pack 3, Microsoft Windows 2000 Service Pack 4, and the original release version of Microsoft Windows Server 2003 (all languages)

    This software updates the Background Intelligent Transfer Service (BITS) to version 2.0, and it also updates WinHTTP. These updates help guarantee an optimal download experience by using new versions of Automatic Updates, Windows Update, and other programs that rely on BITS to transfer files by using idle network bandwidth. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    842773  (http://support.microsoft.com/kb/842773/ ) An update package that includes BITS 2.0 and WinHTTP 5.1 is available for Windows Server 2003, for Windows XP, and for Windows 2000

Changes to existing software updates

Changes to text for software updates:


Recommended update for Microsoft DirectX 9.0 - Managed DirectX
  • DirectX 9.0a Managed DirectX update: The Korean "read more" link was corrected.

Changes to existing security updates

The changes in the following list were made between February 9, 2005 and February 15, 2005. These changes do not require the software updates to be reinstalled. However, Windows Update Services beta users may notice that these software updates appear to have changed. These changes do not represent cases where a software update was offered to a computer that does not require it, or where a software update was not offered to a computer that requires it.
  • The security level and the security bulletin number were missing from the content that is associated with the following software updates:
    324380  (http://support.microsoft.com/kb/324380/ ) MS02-051: Cryptographic flaw in RDP protocol can cause information disclosure

    811114  (http://support.microsoft.com/kb/811114/ ) MS03-018: May 2003 Cumulative patch for Internet Information Services (IIS)

    828028  (http://support.microsoft.com/kb/828028/ ) MS04-007: An ASN.1 vulnerability could allow code execution

    828741  (http://support.microsoft.com/kb/828741/ ) MS04-012: Cumulative update for Microsoft RPC/DCOM

    830352  (http://support.microsoft.com/kb/830352/ ) MS04-006: A vulnerability in the Windows Internet Name Service (WINS) could allow code execution

    832359  (http://support.microsoft.com/kb/832359/ ) MS04-008: Vulnerability in Windows Media Services could allow a Denial of Service attack

    832483  (http://support.microsoft.com/kb/832483/ ) MS04-003: Buffer overrun in an MDAC function could allow code execution

    832894  (http://support.microsoft.com/kb/832894/ ) MS04-004: Cumulative security update for Internet Explorer

    835732  (http://support.microsoft.com/kb/835732/ ) MS04-011: Security update for Microsoft Windows

    837001  (http://support.microsoft.com/kb/837001/ ) MS04-014: Vulnerability in the Microsoft Jet Database Engine could permit code execution

    837009  (http://support.microsoft.com/kb/837009/ ) MS04-013: Cumulative security update for Outlook Express

    840374  (http://support.microsoft.com/kb/840374/ ) MS04-015: Security update for Microsoft Windows
  • The following software updates were incorrectly registered as requiring a user interface when they are installed by SUS:
    867801  (http://support.microsoft.com/kb/867801/ ) MS04-025: Cumulative security update for Internet Explorer

    888162  (http://support.microsoft.com/kb/888162/ ) You receive an "Explorer.EXE - Entry Point Not Found - The procedure entry point SHCreateThreadRef could not be located in the dynamic link library Shlwapi.dll" error message after you install the MS04-038 security update

    816093  (http://support.microsoft.com/kb/816093/ ) MS03-011: Flaw in the Microsoft VM could enable system compromise
  • The severity rating was changed from Important to Critical:
    835732  (http://support.microsoft.com/kb/835732/ ) MS04-011: Security update for Microsoft Windows
http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx (http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx)

Tuesday, February 8, 2005

New security updates

  • ASP.NET path validation vulnerability in Microsoft .NET Framework 1.0 Service Pack 3 (KB886906)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified that could allow an attacker to compromise a Microsoft Windows-based computer that is running the Microsoft .NET Framework and to gain access to restricted data. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer.
    http://www.microsoft.com/technet/security/bulletin/MS05-004.mspx (http://www.microsoft.com/technet/security/bulletin/MS05-004.mspx)
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    886906  (http://support.microsoft.com/kb/886906/ ) ASP.NET path validation vulnerability in Microsoft .NET Framework 1.0 Service Pack 3
  • ASP.NET path validation vulnerability in Microsoft .NET Framework 1.1 Service Pack 1 (KB886903)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified that could allow an attacker to compromise a Microsoft Windows-based computer that is running the Microsoft .NET Framework and to gain access to restricted data. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer.
    http://www.microsoft.com/technet/security/bulletin/MS05-004.mspx (http://www.microsoft.com/technet/security/bulletin/MS05-004.mspx)
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    886903  (http://support.microsoft.com/kb/886903/ ) ASP.NET path validation vulnerability in Microsoft .NET Framework 1.1 Service Pack 1
  • ASP.NET path validation vulnerability in Microsoft .NET Framework 1.0 Service Pack 3 on Windows XP Media Center and Tablet PC Editions (KB887998)

    Microsoft Windows XP Tablet Edition, Microsoft Windows Media Center Edition

    A security issue has been identified that could allow an attacker to compromise a Microsoft Windows-based computer that is running the Microsoft .NET Framework and to gain access to restricted data. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer.
    http://www.microsoft.com/technet/security/bulletin/MS05-004.mspx (http://www.microsoft.com/technet/security/bulletin/MS05-004.mspx)
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    887998  (http://support.microsoft.com/kb/887998/ ) ASP.NET path validation vulnerability in Microsoft .NET Framework 1.0 Service Pack 3 on Windows XP Media Center and Tablet PC Editions
  • MS05-006: Vulnerability in Windows SharePoint Services and SharePoint Team Services could allow cross-site scripting and spoofing attacks (KB887981)

    Microsoft Windows Server 2003

    A security issue has been identified that could allow an attacker to compromise a Microsoft Windows-based computer and to gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer.
    http://www.microsoft.com/technet/security/bulletin/MS05-006.mspx (http://www.microsoft.com/technet/security/bulletin/MS05-006.mspx)
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    887981  (http://support.microsoft.com/kb/887981/ ) MS05-006: Vulnerability in Windows SharePoint Services and SharePoint Team Services could allow cross-site scripting and spoofing attacks
  • MS05-007: Vulnerability in Windows could allow information disclosure (KB888302)

    Microsoft Windows XP

    A security issue has been identified that could allow an attacker to remotely read information about a Microsoft Windows-based computer. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer.
    http://www.microsoft.com/technet/security/bulletin/MS05-007.mspx (http://www.microsoft.com/technet/security/bulletin/MS05-007.mspx)
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    888302  (http://support.microsoft.com/kb/888302/ ) MS05-007: Vulnerability in Windows could allow information disclosure
  • MS05-008: Vulnerability in Windows shell could allow remote code execution (KB890047)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified that could allow an attacker to compromise a Microsoft Windows-based computer and to gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer.
    http://www.microsoft.com/technet/security/bulletin/MS05-008.mspx (http://www.microsoft.com/technet/security/bulletin/MS05-008.mspx)
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    890047  (http://support.microsoft.com/kb/890047/ ) MS05-008: Vulnerability in Windows shell could allow remote code execution
  • Microsoft has released a security update to Microsoft Windows Media Player 9 (KB885492)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000, Microsoft Windows Millennium Edition, Microsoft Windows 98 Second Edition, Microsoft Windows 98

    A security issue has been identified that could allow an attacker to compromise a Microsoft Windows-based computer and to gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer.
    http://www.microsoft.com/technet/security/bulletin/MS05-009.mspx (http://www.microsoft.com/technet/security/bulletin/MS05-009.mspx)
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    885492  (http://support.microsoft.com/kb/885492/ ) Microsoft has released a security update to Microsoft Windows Media Player 9
  • Microsoft has released a security update to Microsoft Windows Messenger (KB887472)

    Microsoft Windows XP

    A security issue has been identified that could allow an attacker to compromise a Microsoft Windows-based computer and to gain control over it. You can help protect the computer by installing this update from Microsoft. After you install this update, you may have to restart the computer.
    http://www.microsoft.com/technet/security/bulletin/MS05-009.mspx (http://www.microsoft.com/technet/security/bulletin/MS05-009.mspx)
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    887472  (http://support.microsoft.com/kb/887472/ ) Microsoft has released a security update to Microsoft Windows Messenger
  • MS05-010: Vulnerability in the License Logging service could allow code execution (KB885834)

    Microsoft Windows Server 2003, Microsoft Windows 2000

    A security issue has been identified that could allow an attacker to compromise a Microsoft Windows-based computer and to gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer.
    http://www.microsoft.com/technet/security/bulletin/MS05-010.mspx (http://www.microsoft.com/technet/security/bulletin/MS05-010.mspx)
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    885834  (http://support.microsoft.com/kb/885834/ ) MS05-010: Vulnerability in the License Logging service could allow code execution
  • MS05-011: Vulnerability in server message block could allow remote code execution (KB885250)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified that could allow an attacker to compromise a Microsoft Windows-based computer and to gain control over it. You can help protect the computer by installing this update from Microsoft. After you install this update, you may have to restart the computer.
    http://www.microsoft.com/technet/security/bulletin/MS05-011.mspx (http://www.microsoft.com/technet/security/bulletin/MS05-011.mspx)
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    885250  (http://support.microsoft.com/kb/885250/ ) MS05-011: Vulnerability in server message block could allow remote code execution
  • MS05-012: Vulnerability in OLE and COM could allow remote code execution (KB873333)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified that could allow an attacker to compromise a Microsoft Windows-based computer and to gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer.
    http://www.microsoft.com/technet/security/bulletin/MS05-012.mspx (http://www.microsoft.com/technet/security/bulletin/MS05-012.mspx)
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    873333  (http://support.microsoft.com/kb/873333/ ) MS05-012: Vulnerability in OLE and COM could allow remote code execution
  • MS05-013: A vulnerability in the DHTML editing component ActiveX control could allow code execution (KB891781)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000, Microsoft Windows Millennium Edition, Microsoft Windows 98 Second Edition

    A security issue has been identified that could allow an attacker to compromise a Microsoft Windows-based computer and to gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer.
    http://www.microsoft.com/technet/security/bulletin/MS05-013.mspx (http://www.microsoft.com/technet/security/bulletin/MS05-013.mspx)
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    891781  (http://support.microsoft.com/kb/891781/ ) MS05-013: A vulnerability in the DHTML editing component ActiveX control could allow code execution
  • MS05-014: Cumulative security update for Internet Explorer (KB867282)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000, Microsoft Windows Millennium Edition, Microsoft Windows 98 Second Edition

    A security issue has been identified that could allow an attacker to compromise a computer that is running Microsoft Internet Explorer and to gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer.
    http://www.microsoft.com/technet/security/bulletin/MS05-014.mspx (http://www.microsoft.com/technet/security/bulletin/MS05-014.mspx)
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    867282  (http://support.microsoft.com/kb/867282/ ) MS05-014: Cumulative security update for Internet Explorer
  • MS05-015: Vulnerability in hyperlink object library could allow remote code execution (KB888113)

    Microsoft Windows Server 2003, Microsoft Windows XP, Microsoft Windows 2000

    A security issue has been identified that could allow an attacker to compromise a Microsoft Windows-based computer and to gain control over it. You can help protect a computer by installing this update from Microsoft. After you install this update, you may have to restart the computer.
    http://www.microsoft.com/technet/security/bulletin/MS05-015.mspx (http://www.microsoft.com/technet/security/bulletin/MS05-015.mspx)
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    888113  (http://support.microsoft.com/kb/888113/ ) MS05-015: Vulnerability in hyperlink object library could allow remote code execution in Windows Server 2003

New critical updates

There are no new critical updates.

Changes to existing content

The following changes were made to existing content and software updates on Tuesday, February 8, 2005.

Changes to software update detection:
  • MS02-050: Certificate validation flaw might permit identity spoofing (KB329115)

    Security update for Windows 2000. The detection for this package has to be changed so that the package is reoffered if the file is downgraded. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    329115  (http://support.microsoft.com/kb/329115/ ) MS02-050: Certificate validation flaw might permit identity spoofing
  • MS04-024: A vulnerability in the Windows shell could allow remote code execution (KB839645)

    The current package has a generic registry key in detection. The detection for this package has to be changed to remove this registry key and to use file-version detection. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    839645  (http://support.microsoft.com/kb/839645/ ) MS04-024: A vulnerability in the Windows shell could allow remote code execution
Replaced software updates:
  • MS03-021: A flaw in Windows Media Player may permit the Media Library to be accessed (KB819639)

    This package is superseded by security bulletin MS05-009 (885492). For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    819639  (http://support.microsoft.com/kb/819639/ ) MS03-021: A flaw in Windows Media Player may permit the Media Library to be accessed
  • MS04-038: Cumulative security update for Internet Explorer (KB834707)

    This package is superseded by MS05-014 (867282) on all supported non-Internet Explorer 6 Service Pack 1 (SP1) operating system/Internet Explorer 6 combinations. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    834707  (http://support.microsoft.com/kb/834707/ ) MS04-038: Cumulative security update for Internet Explorer
  • MS04-040: Cumulative security update for Internet Explore (KB889293)

    This package is superseded by MS05-014 (867282) for Internet Explorer 6 SP1 versions. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    889293  (http://support.microsoft.com/kb/889293/ ) MS04-040: Cumulative security update for Internet Explorer
  • Windows Messenger version 4.7.2009 will no longer be available for download. It is superseded by Windows Messenger version 4.7.2010.
Expired software updates:


The following items have previously been removed from the site and are now expiring on SUS. This is per the agreement to keep content on SUS for one additional year.
  • MS03-010: Flaw in RPC endpoint mapper could allow Denial of Service attacks (KB331953)

    Security update for Windows
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    331953  (http://support.microsoft.com/kb/331953/ ) MS03-010: Flaw in RPC endpoint mapper could allow Denial of Service attacks
Changes to text for software updates:


The following updates have text changes, either to the title or to the description. However, there is no change to the package or to the detection logic used.
  • Microsoft .NET Framework version 1.1 German Language Pack. There is a change to the description of this software update.

REFERENCES

For more information about the description of Software Update Services and Windows Server Update Services changes in content for 2007, click the following article number to view the article in the Microsoft Knowledge Base:
894199  (http://support.microsoft.com/kb/894199/ ) Description of Software Update Services and Windows Server Update Services changes in content for 2007
For more information about the description of Software Update Services and Windows Server Update Services changes in content for 2006, click the following article number to view the article in the Microsoft Knowledge Base:
930858  (http://support.microsoft.com/kb/930858/ ) Description of Software Update Services and Windows Server Update Services changes in content for 2006


The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

APPLIES TO
  • Microsoft Software Update Services 1.0
Keywords: 
kbsecurity kbinfo KB918043
Share
Additional support options
Ask The Microsoft Small Business Support Community
Contact Microsoft Small Business Support
Find Microsoft Small Business Support Certified Partner
Find a Microsoft Store For In-Person Small Business Support