Microsoft Security Bulletin MS10-020 - Critical

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

What is the scope of the vulnerability? 
This is a denial of service vulnerability. An attacker who exploited this vulnerability could cause the affected system to stop responding until it is manually restarted. Note that the denial of service vulnerability would not allow an attacker to execute code or to elevate their user rights, but it could cause the affected system to stop responding until manually restarted.

What causes the vulnerability? 
The vulnerability exists because the Microsoft Server Message Block (SMB) client implementation incorrectly handles incomplete SMB responses.

What is Microsoft Server Message Block (SMB) protocol? 
Microsoft Server Message Block (SMB) protocol is a Microsoft network file sharing protocol used in Microsoft Windows. For more information on SMB, see the MSDN article, Microsoft SMB Protocol and CIFS Protocol Overview.

What is Microsoft Server Message Block Version 2 (SMBv2)? 
Server Message Block (SMB) is the file sharing protocol used by default on Windows-based computers. SMB Version 2.0 (SMBv2) is an update to this protocol, and is only supported on computers running Windows Server 2008, Windows 7, and Windows Vista. SMBv2 can only be used if both client and server support it. If either client or server cannot support SMBv2, the SMB 1.0 protocol will be used instead. The SMB protocol version to be used for file operations is decided during the negotiation phase. During the negotiation phase, a Windows Vista client advertises to the server that it can understand the new SMBv2 protocol. If the server (Windows Server 2008 or later) understands SMBv2, then SMBv2 is chosen for subsequent communication. Otherwise the client and server use SMB 1.0 and continue to function as normal. For more information on SMBv2, see the MSDN article, Server Message Block (SMB) Version 2 Protocol Specification.

What is the difference between SMBv1 and SMBv2? 
Both protocols are used by clients to request file and print services from a server system over the network. Both are stateful protocols in which clients establish a connection to a server, establish an authenticated context on that connection, and then issue a variety of requests to access files, printers, and named pipes for interprocess communication. The SMBv2 protocol is a major revision of the existing SMB protocol. While many of the underlying concepts are the same, the packet formats are completely different. In addition to providing all of the capabilities found in SMBv1, the SMBv2 protocol provides several enhancements:

What versions of SMB are impacted by this vulnerability? 
This vulnerability affects both SMBv1 and SMBv2.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could cause a user's system to stop responding until manually restarted.

How could an attacker exploit the vulnerability? 
An attacker could host a specially crafted SMB server that is designed to exploit this vulnerability and then convince a user to initiate an SMB connection with it. Additionally, an attacker on the local network could perform a man-in-the-middle attack to respond to a legitimate SMB request with a malformed SMB response.

What systems are primarily at risk from the vulnerability? 
All affected operating systems are at risk.

Can this vulnerability be exploited using Internet Explorer? 
No. However, this issue may be exploited through Web transactions, regardless of browser type. In a Web-based attack scenario, an attacker would have to host a Web page that contains a specially crafted URI. A user who browsed that Web site will force an SMB connection to an SMB server controlled by the attacker, which would then send a malformed response back to the user. This response would result in the users' system becoming nonresponsive. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince them to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes them to the attacker's site.

What is a URI? 
A Uniform Resource Identifier (URI) is a string of characters used to act on or identify resources from the Internet or over a network. A URL is a typical example of a URI that references a resource such as a Web site. For more information about URIs, see RFC-2396.

What does the update do? 
The security update addresses the vulnerability by correcting the manner in which the SMB client handles incomplete SMB responses.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CVE-2009-3676.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

What is the scope of the vulnerability? 
This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability? 
The vulnerability exists because the Microsoft Server Message Block (SMB) client implementation improperly allocates memory when parsing specially crafted SMB responses.

What is Microsoft Server Message Block (SMB) protocol? 
Microsoft Server Message Block (SMB) protocol is a Microsoft network file sharing protocol used in Microsoft Windows. For more information on SMB, see the MSDN article, Microsoft SMB Protocol and CIFS Protocol Overview.

What is Microsoft Server Message Block Version 2 (SMBv2)? 
Server Message Block (SMB) is the file sharing protocol used by default on Windows-based computers. SMB Version 2.0 (SMBv2) is an update to this protocol, and is only supported on computers running Windows Server 2008, Windows 7, and Windows Vista. SMBv2 can only be used if both client and server support it. If either client or server cannot support SMBv2, the SMB 1.0 protocol will be used instead. The SMB protocol version to be used for file operations is decided during the negotiation phase. During the negotiation phase, a Windows Vista client advertises to the server that it can understand the new SMBv2 protocol. If the server (Windows Server 2008 or later) understands SMBv2, then SMBv2 is chosen for subsequent communication. Otherwise the client and server use SMB 1.0 and continue to function as normal. For more information on SMBv2, see the MSDN article, Server Message Block (SMB) Version 2 Protocol Specification.

What is the difference between SMBv1 and SMBv2? 
Both protocols are used by clients to request file and print services from a server system over the network. Both are stateful protocols in which clients establish a connection to a server, establish an authenticated context on that connection, and then issue a variety of requests to access files, printers, and named pipes for interprocess communication. The SMBv2 protocol is a major revision of the existing SMB protocol. While many of the underlying concepts are the same, the packet formats are completely different. In addition to providing all of the capabilities found in SMBv1, the SMBv2 protocol provides several enhancements:

What versions of SMB are impacted by this vulnerability? 
The issue addressed by this CVE affects both SMBv1 and SMBv2.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could take complete control of an affected system. Most attempts to exploit this vulnerability will cause an affected system to stop responding and restart.

How could an attacker exploit the vulnerability? 
An attacker could host a specially crafted SMB server that is designed to exploit this vulnerability and then convince a user to initiate an SMB connection with it. Additionally, an attacker on the local network could perform a man-in-the-middle attack to respond to a legitimate SMB request with a malformed SMB response.

What systems are primarily at risk from the vulnerability? 
All affected operating systems are at risk.

Can this vulnerability be exploited using Internet Explorer? 
No. However, this issue may be exploited through Web transactions, regardless of browser type. In a Web-based attack scenario, an attacker would have to host a Web page that contains a specially crafted URI. A user who browsed that Web site will force an SMB connection to an SMB server controlled by the attacker, which would then send a malformed response back to the user. This response would result in the users' system becoming nonresponsive. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince them to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes them to the attacker's site.

What is a URI? 
A Uniform Resource Identifier (URI) is a string of characters used to act on or identify resources from the Internet or over a network. A URL is a typical example of a URI that references a resource such as a Web site. For more information about URIs, see RFC-2396.

What does the update do? 
The security update addresses the vulnerability by correcting the manner in which the SMB client allocates memory when parsing specially crafted SMB responses.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through responsible disclosure.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

What is the scope of the vulnerability? 
This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability? 
The vulnerability exists because by the Microsoft Server Message Block (SMB) client improperly validates fields in the SMB response. This could lead to a memory corruption issue resulting in code execution with system-level privileges.

What is Microsoft Server Message Block (SMB) protocol? 
Microsoft Server Message Block (SMB) protocol is a Microsoft network file sharing protocol used in Microsoft Windows. For more information on SMB, see the MSDN article, Microsoft SMB Protocol and CIFS Protocol Overview.

What is Microsoft Server Message Block Version 2 (SMBv2)? 
Server Message Block (SMB) is the file sharing protocol used by default on Windows-based computers. SMB Version 2.0 (SMBv2) is an update to this protocol, and is only supported on computers running Windows Server 2008, Windows 7, and Windows Vista. SMBv2 can only be used if both client and server support it. If either client or server cannot support SMBv2, the SMB 1.0 protocol will be used instead. The SMB protocol version to be used for file operations is decided during the negotiation phase. During the negotiation phase, a Windows Vista client advertises to the server that it can understand the new SMBv2 protocol. If the server (Windows Server 2008 or later) understands SMBv2, then SMBv2 is chosen for subsequent communication. Otherwise the client and server use SMB 1.0 and continue to function as normal. For more information on SMBv2, see the MSDN article, Server Message Block (SMB) Version 2 Protocol Specification.

What is the difference between SMBv1 and SMBv2? 
Both protocols are used by clients to request file and print services from a server system over the network. Both are stateful protocols in which clients establish a connection to a server, establish an authenticated context on that connection, and then issue a variety of requests to access files, printers, and named pipes for interprocess communication. The SMBv2 protocol is a major revision of the existing SMB protocol. While many of the underlying concepts are the same, the packet formats are completely different. In addition to providing all of the capabilities found in SMBv1, the SMBv2 protocol provides several enhancements:

What versions of SMB are impacted by this vulnerability? 
The issue addressed by this CVE affects both SMBv1 and SMBv2.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could take complete control of an affected system. Most attempts to exploit this vulnerability will cause an affected system to stop responding and restart.

How could an attacker exploit the vulnerability? 
An attacker could host a specially crafted SMB server that is designed to exploit this vulnerability and then convince a user to initiate an SMB connection with it. Additionally, an attacker on the local network could perform a man-in-the-middle attack to respond to a legitimate SMB request with a malformed SMB response.

What systems are primarily at risk from the vulnerability? 
All affected operating systems are at risk.

Can this vulnerability be exploited using Internet Explorer? 
No. However, this issue may be exploited through Web transactions, regardless of browser type. In a Web-based attack scenario, an attacker would have to host a Web page that contains a specially crafted URI. A user who browsed that Web site will force an SMB connection to an SMB server controlled by the attacker, which would then send a malformed response back to the user. This response would result in the users' system becoming nonresponsive. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince them to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes them to the attacker's site.

What is a URI? 
A Uniform Resource Identifier (URI) is a string of characters used to act on or identify resources from the Internet or over a network. A URL is a typical example of a URI that references a resource such as a Web site. For more information about URIs, see RFC-2396.

What does the update do? 
The security update addresses the vulnerability by correcting the manner in which fields within the SMB response are validated.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through responsible disclosure.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

What is the scope of the vulnerability? 
This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability? 
The vulnerability exists because the Microsoft Server Message Block (SMB) client implementation improperly parses specially crafted SMB transaction responses. This could lead to a memory corruption issue resulting in code execution with system-level privileges.

What is Microsoft Server Message Block (SMB) protocol? 
Microsoft Server Message Block (SMB) protocol is a Microsoft network file sharing protocol used in Microsoft Windows. For more information on SMB, see the MSDN article, Microsoft SMB Protocol and CIFS Protocol Overview.

What is Microsoft Server Message Block Version 2 (SMBv2)? 
Server Message Block (SMB) is the file sharing protocol used by default on Windows-based computers. SMB Version 2.0 (SMBv2) is an update to this protocol, and is only supported on computers running Windows Server 2008, Windows 7, and Windows Vista. SMBv2 can only be used if both client and server support it. If either client or server cannot support SMBv2, the SMB 1.0 protocol will be used instead. The SMB protocol version to be used for file operations is decided during the negotiation phase. During the negotiation phase, a Windows Vista client advertises to the server that it can understand the new SMBv2 protocol. If the server (Windows Server 2008 or later) understands SMBv2, then SMBv2 is chosen for subsequent communication. Otherwise the client and server use SMB 1.0 and continue to function as normal. For more information on SMBv2, see the MSDN article, Server Message Block (SMB) Version 2 Protocol Specification.

What is the difference between SMBv1 and SMBv2? 
Both protocols are used by clients to request file and print services from a server system over the network. Both are stateful protocols in which clients establish a connection to a server, establish an authenticated context on that connection, and then issue a variety of requests to access files, printers, and named pipes for interprocess communication. The SMBv2 protocol is a major revision of the existing SMB protocol. While many of the underlying concepts are the same, the packet formats are completely different. In addition to providing all of the capabilities found in SMBv1, the SMBv2 protocol provides several enhancements:

What versions of SMB are impacted by this vulnerability? 
This vulnerability affects both SMBv1 and SMBv2.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could take complete control of an affected system. Most attempts to exploit this vulnerability will cause an affected system to stop responding and restart.

How could an attacker exploit the vulnerability? 
An attacker could host a specially crafted SMB server that is designed to exploit this vulnerability and then convince a user to initiate an SMB connection with it. Additionally, an attacker on the local network could perform a man-in-the-middle attack to respond to a legitimate SMB request with a malformed SMB response.

What systems are primarily at risk from the vulnerability? 
All affected operating systems are at risk.

Why are Windows 7 and Windows Server 2008 R2 listed as Low severity? 
Although this vulnerability does not directly affect these platforms, there may be third-party TDI filters vulnerable to this issue. The update addresses this issue. These platforms are not delivered with any TDI filters that are vulnerable to this issue. Microsoft is not aware of any third-party TDI filters that are affected by this issue.

Can this vulnerability be exploited using Internet Explorer? 
No. However, this issue may be exploited through Web transactions, regardless of browser type. In a Web-based attack scenario, an attacker would have to host a Web page that contains a specially crafted URI. A user who browsed that Web site will force an SMB connection to an SMB server controlled by the attacker, which would then send a malformed response back to the user. This response would result in the users' system becoming nonresponsive. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince them to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes them to the attacker's site.

What is a URI? 
A Uniform Resource Identifier (URI) is a string of characters used to act on or identify resources from the Internet or over a network. A URL is a typical example of a URI that references a resource such as a Web site. For more information about URIs, see RFC-2396.

What does the update do? 
The security update addresses the vulnerability by correcting the manner in which the SMB client parses specially crafted SMB transaction responses.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through responsible disclosure.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

What is the scope of the vulnerability? 
This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability? 
The vulnerability exists because the Microsoft Server Message Block (SMB) client implementation improperly handles specially crafted SMB responses that cause the SMB client to consume the entire response and indicate an invalid value to the Winsock kernel.

What is Microsoft Server Message Block (SMB) protocol? 
Microsoft Server Message Block (SMB) protocol is a Microsoft network file sharing protocol used in Microsoft Windows. For more information on SMB, see the MSDN article, Microsoft SMB Protocol and CIFS Protocol Overview.

What is Microsoft Server Message Block Version 2 (SMBv2)? 
Server Message Block (SMB) is the file sharing protocol used by default on Windows-based computers. SMB Version 2.0 (SMBv2) is an update to this protocol, and is only supported on computers running Windows Server 2008, Windows 7, and Windows Vista. SMBv2 can only be used if both client and server support it. If either client or server cannot support SMBv2, the SMB 1.0 protocol will be used instead. The SMB protocol version to be used for file operations is decided during the negotiation phase. During the negotiation phase, a Windows Vista client advertises to the server that it can understand the new SMBv2 protocol. If the server (Windows Server 2008 or later) understands SMBv2, then SMBv2 is chosen for subsequent communication. Otherwise the client and server use SMB 1.0 and continue to function as normal. For more information on SMBv2, see the MSDN article, Server Message Block (SMB) Version 2 Protocol Specification.

What is the difference between SMBv1 and SMBv2? 
Both protocols are used by clients to request file and print services from a server system over the network. Both are stateful protocols in which clients establish a connection to a server, establish an authenticated context on that connection, and then issue a variety of requests to access files, printers, and named pipes for interprocess communication. The SMBv2 protocol is a major revision of the existing SMB protocol. While many of the underlying concepts are the same, the packet formats are completely different. In addition to providing all of the capabilities found in SMBv1, the SMBv2 protocol provides several enhancements:

What versions of SMB are impacted by this vulnerability? 
The issue addressed by this CVE affects both SMBv1 and SMBv2.

What is the Winsock Kernel? 
The Winsock Kernel (WSK) is a kernel-mode Network Programming Interface (NPI). With WSK, kernel-mode software modules can perform network I/O operations using the same socket programming concepts that are supported by user-mode Winsock2. The WSK NPI supports familiar socket operations such as socket creation, binding, connection establishment, and data transfers (send and receive). However, while the WSK NPI supports most of the same socket programming concepts as user-mode Winsock2, it is a completely new and different interface with unique characteristics such as asynchronous I/O that uses IRPs and event callbacks to enhance performance. For more information, see the MSDN article, Winsock Kernel.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could take complete control of an affected system. Most attempts to exploit this vulnerability will cause an affected system to stop responding and restart.

How could an attacker exploit the vulnerability? 
An attacker could host a specially crafted SMB server that is designed to exploit this vulnerability and then convince a user to initiate an SMB connection with it. Additionally, an attacker on the local network could perform a man-in-the-middle attack to respond to a legitimate SMB request with a malformed SMB response.

What systems are primarily at risk from the vulnerability? 
All affected operating systems are at risk.

Can this vulnerability be exploited using Internet Explorer? 
No. However, this issue may be exploited through Web transactions, regardless of browser type. In a Web-based attack scenario, an attacker would have to host a Web page that contains a specially crafted URI. A user who browsed that Web site will force an SMB connection to an SMB server controlled by the attacker, which would then send a malformed response back to the user. This response would result in the users' system becoming nonresponsive. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince them to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes them to the attacker's site.

What is a URI? 
A Uniform Resource Identifier (URI) is a string of characters used to act on or identify resources from the Internet or over a network. A URL is a typical example of a URI that references a resource such as a Web site. For more information about URIs, see RFC-2396.

What does the update do? 
The security update addresses the vulnerability by correcting the manner in which the SMB client handles specially crafted SMB responses.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through responsible disclosure.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Installing the Update

When you install this security update, the installer checks whether one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

If you have previously installed a hotfix to update one of these files, the installer copies the RTMQFE, SP1QFE, or SP2QFE files to your system. Otherwise, the installer copies the RTMGDR, SP1GDR, or SP2GDR files to your system. Security updates may not contain all variations of these files. For more information about this behavior, see Microsoft Knowledge Base Article 824994.

For more information about the installer, visit the Microsoft TechNet Web site.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/overwriteoem	Overwrites OEM files without prompting.
/nobackup	Does not back up files needed for uninstall.
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.
/extract[:path]	Extracts files without starting the Setup program.
/ER	Enables extended error reporting.
/verbose	Enables verbose logging. During installation, creates %Windir%\CabBuild.log. This log details the files that are copied. Using this switch may cause the installation to proceed more slowly.

Note You can combine these switches into one command. For backward compatibility, the security update also supports the setup switches that the earlier version of the Setup program uses. For more information about the supported installation switches, see Microsoft Knowledge Base Article 262841.

Removing the Update

This security update supports the following setup switches.

Supported Spuninst.exe Switches
Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.

Verifying That the Update Has Been Applied

•

Microsoft Baseline Security Analyzer To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

•

File Version Verification Because there are several editions of Microsoft Windows, the following steps may be different on your system. If they are, see your product documentation to complete these steps. 1. Click Start, and then click Search. 2. In the Search Results pane, click All files and folders under Search Companion. 3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search. 4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties. Note Depending on the edition of the operating system, or the programs that are installed on your system, some of the files that are listed in the file information table may not be installed. 5. On the Version tab, determine the version of the file that is installed on your system by comparing it to the version that is documented in the appropriate file information table. Note Attributes other than the file version may change during installation. Comparing other file attributes to the information in the file information table is not a supported method of verifying that the update has been applied. Also, in certain cases, files may be renamed during installation. If the file or version information is not present, use one of the other available methods to verify update installation.

•

Registry Key Verification You may also be able to verify the files that this security update has installed by reviewing the registry keys listed in the Reference Table in this section. These registry keys may not contain a complete list of installed files. Also, these registry keys may not be created correctly when an administrator or an OEM integrates or slipstreams this security update into the Windows installation source files.

Top of section

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Note For supported versions of Windows XP Professional x64 Edition, this security update is the same as supported versions of the Windows Server 2003 x64 Edition security update.

Installing the Update

When you install this security update, the installer checks whether one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

If you have previously installed a hotfix to update one of these files, the installer copies the RTMQFE, SP1QFE, or SP2QFE files to your system. Otherwise, the installer copies the RTMGDR, SP1GDR, or SP2GDR files to your system. Security updates may not contain all variations of these files. For more information about this behavior, see Microsoft Knowledge Base Article 824994.

For more information about the installer, visit the Microsoft TechNet Web site.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/overwriteoem	Overwrites OEM files without prompting.
/nobackup	Does not back up files needed for uninstall.
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.
/integrate:path	Integrates the update into the Windows source files. These files are located at the path that is specified in the switch.
/extract[:path]	Extracts files without starting the Setup program.
/ER	Enables extended error reporting.
/verbose	Enables verbose logging. During installation, creates %Windir%\CabBuild.log. This log details the files that are copied. Using this switch may cause the installation to proceed more slowly.

Note You can combine these switches into one command. For backward compatibility, the security update also supports the setup switches that the earlier version of the Setup program uses. For more information about the supported installation switches, see Microsoft Knowledge Base Article 262841.

Removing the Update

This security update supports the following setup switches.

Supported Spuninst.exe Switches
Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.

Verifying That the Update Has Been Applied

•

Microsoft Baseline Security Analyzer To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

•

File Version Verification Because there are several editions of Microsoft Windows, the following steps may be different on your system. If they are, see your product documentation to complete these steps. 1. Click Start, and then click Search. 2. In the Search Results pane, click All files and folders under Search Companion. 3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search. 4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties. Note Depending on the edition of the operating system, or the programs that are installed on your system, some of the files that are listed in the file information table may not be installed. 5. On the Version tab, determine the version of the file that is installed on your system by comparing it to the version that is documented in the appropriate file information table. Note Attributes other than the file version may change during installation. Comparing other file attributes to the information in the file information table is not a supported method of verifying that the update has been applied. Also, in certain cases, files may be renamed during installation. If the file or version information is not present, use one of the other available methods to verify update installation.

•

Registry Key Verification You may also be able to verify the files that this security update has installed by reviewing the registry keys listed in the Reference Table in this section. These registry keys may not contain a complete list of installed files. Also, these registry keys may not be created correctly when an administrator or an OEM integrates or slipstreams this security update into the Windows installation source files.

Top of section

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Installing the Update

When you install this security update, the installer checks to see if one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

If you have previously installed a hotfix to update one of these files, the installer copies the RTMQFE, SP1QFE, or SP2QFE files to your system. Otherwise, the installer copies the RTMGDR, SP1GDR, or SP2GDR files to your system. Security updates may not contain all variations of these files. For more information about this behavior, see Microsoft Knowledge Base Article 824994.

For more information about the installer, visit the Microsoft TechNet Web site.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/overwriteoem	Overwrites OEM files without prompting.
/nobackup	Does not back up files needed for uninstall.
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.
/integrate:path	Integrates the update into the Windows source files. These files are located at the path that is specified in the switch.
/extract[:path]	Extracts files without starting the Setup program.
/ER	Enables extended error reporting.
/verbose	Enables verbose logging. During installation, creates %Windir%\CabBuild.log. This log details the files that are copied. Using this switch may cause the installation to proceed more slowly.

Note You can combine these switches into one command. For backward compatibility, the security update also supports many of the setup switches that the earlier version of the Setup program uses. For more information about the supported installation switches, see Microsoft Knowledge Base Article 262841.

Removing the Update

This security update supports the following setup switches.

Supported Spuninst.exe Switches
Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.

Verifying that the Update Has Been Applied

•

Microsoft Baseline Security Analyzer To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

•

File Version Verification Because there are several editions of Microsoft Windows, the following steps may be different on your system. If they are, see your product documentation to complete these steps. 1. Click Start, and then click Search. 2. In the Search Results pane, click All files and folders under Search Companion. 3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search. 4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties. Note Depending on the edition of the operating system, or the programs that are installed on your system, some of the files that are listed in the file information table may not be installed. 5. On the Version tab, determine the version of the file that is installed on your system by comparing it to the version that is documented in the appropriate file information table. Note Attributes other than the file version may change during installation. Comparing other file attributes to the information in the file information table is not a supported method of verifying that the update has been applied. Also, in certain cases, files may be renamed during installation. If the file or version information is not present, use one of the other available methods to verify update installation.

•

Registry Key Verification You may also be able to verify the files that this security update has installed by reviewing the registry keys listed in the Reference Table in this section. These registry keys may not contain a complete list of installed files. Also, these registry keys may not be created correctly when an administrator or an OEM integrates or slipstreams this security update into the Windows installation source files.

Top of section

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Installing the Update

When you install this security update, the installer checks whether one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
Switch	Description
/?, /h, /help	Displays help on supported switches.
/quiet	Suppresses the display of status or error messages.
/norestart	When combined with /quiet, the system will not be restarted after installation even if a restart is required to complete installation.

Note For more information about the wusa.exe installer, see Microsoft Knowledge Base Article 934307.

Verifying That the Update Has Been Applied

•

Microsoft Baseline Security Analyzer To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

•

File Version Verification Because there are several editions of Microsoft Windows, the following steps may be different on your system. If they are, see your product documentation to complete these steps. 1. Click Start and then enter an update file name in Start Search. 2. When the file appears under Programs, right-click on the file name and click Properties. 3. Under the General tab, compare the file size with the file information tables provided in the bulletin KB article. 4. You may also click on the Details tab and compare information, such as file version and date modified, with the file information tables provided in the bulletin KB article. 5. Finally, you may also click on the Previous Versions tab and compare file information for the previous version of the file with the file information for the new, or updated, version of the file.

Top of section

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Installing the Update

When you install this security update, the installer checks whether one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
Switch	Description
/?, /h, /help	Displays help on supported switches.
/quiet	Suppresses the display of status or error messages.
/norestart	When combined with /quiet, the system will not be restarted after installation even if a restart is required to complete installation.

Note For more information about the wusa.exe installer, see Microsoft Knowledge Base Article 934307.

Verifying That the Update Has Been Applied

•

Microsoft Baseline Security Analyzer To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

•

File Version Verification Because there are several editions of Microsoft Windows, the following steps may be different on your system. If they are, see your product documentation to complete these steps. 1. Click Start and then enter an update file name in Start Search. 2. When the file appears under Programs, right-click on the file name and click Properties. 3. Under the General tab, compare the file size with the file information tables provided in the bulletin KB article. 4. You may also click on the Details tab and compare information, such as file version and date modified, with the file information tables provided in the bulletin KB article. 5. Finally, you may also click on the Previous Versions tab and compare file information for the previous version of the file with the file information for the new, or updated, version of the file.

Top of section

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Installing the Update

When you install this security update, the installer checks whether one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
Switch	Description
/?, /h, /help	Displays help on supported switches.
/quiet	Suppresses the display of status or error messages.
/norestart	When combined with /quiet, the system will not be restarted after installation even if a restart is required to complete installation.

Note For more information about the wusa.exe installer, see Microsoft Knowledge Base Article 934307.

Verifying That the Update Has Been Applied

•

Microsoft Baseline Security Analyzer To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

•

File Version Verification Because there are several editions of Microsoft Windows, the following steps may be different on your system. If they are, see your product documentation to complete these steps. 1. Click Start and then enter an update file name in Start Search. 2. When the file appears under Programs, right-click on the file name and click Properties. 3. Under the General tab, compare the file size with the file information tables provided in the bulletin KB article. 4. You may also click on the Details tab and compare information, such as file version and date modified, with the file information tables provided in the bulletin KB article. 5. Finally, you may also click on the Previous Versions tab and compare file information for the previous version of the file with the file information for the new, or updated, version of the file.

Top of section

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Installing the Update

When you install this security update, the installer checks whether one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
Switch	Description
/?, /h, /help	Displays help on supported switches.
/quiet	Suppresses the display of status or error messages.
/norestart	When combined with /quiet, the system will not be restarted after installation even if a restart is required to complete installation.

Note For more information about the wusa.exe installer, see Microsoft Knowledge Base Article 934307.

Verifying That the Update Has Been Applied

•

Microsoft Baseline Security Analyzer To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

•

File Version Verification Because there are several editions of Microsoft Windows, the following steps may be different on your system. If they are, see your product documentation to complete these steps. 1. Click Start and then enter an update file name in Start Search. 2. When the file appears under Programs, right-click on the file name and click Properties. 3. Under the General tab, compare the file size with the file information tables provided in the bulletin KB article. 4. You may also click on the Details tab and compare information, such as file version and date modified, with the file information tables provided in the bulletin KB article. 5. Finally, you may also click on the Previous Versions tab and compare file information for the previous version of the file with the file information for the new, or updated, version of the file.

Top of section