Microsoft KB Archive/925672

= MS06-061: Security update for Microsoft XML Core Services 4.0 SP2 =

Article ID: 925672

Article Last Modified on 10/2/2007

-

APPLIES TO


 * Microsoft XML Core Services 4.0

-



INTRODUCTION
Microsoft has released security bulletin MS06-061. The security bulletin contains all the relevant information about the security update. This information includes file manifest information and deployment options. To view the complete security bulletin, visit one of the following Microsoft Web sites:  Home users:

http://www.microsoft.com/athome/security/update/bulletins/200610.mspx

 IT professionals:

http://www.microsoft.com/technet/security/bulletin/ms06-061.mspx





Known issues with this security update
 You are repeatedly offered this update.

Different versions of MSXML are included with various Microsoft products, such as Windows, Internet Explorer, Microsoft Office, and Microsoft SQL Server, as well as some third-party products. You may be offered this update again if you install a new product or if you update a product that includes a different version of MSXML than you already have. For more information about the different MSXML versions that are available or included with various Microsoft products or software updates, click the following article number to view the article in the Microsoft Knowledge Base:

269238 List of Microsoft XML Parser (MSXML) versions

 Security update packages 925672 and 925673 for MSXML 4.0 Service Pack 2 (SP2) and MSXML 6.0 are complete installation packages. You can use these packages to install MSXML 4.0 SP2 or MSXML 6.0 on a computer that has no earlier versions of MSXML 4.0 or MSXML 6.0 installed. You can also use these packages to update an existing installation of MSXML 4.0, MSXML 4.0 SP1, or MSXML 6.0. Windows Update and Microsoft Update only offer security update packages 925672 and 925673 if an earlier version of MSXML 4.0 SP2 or MSXML 6.0 is already installed on your computer. If you do not have an earlier version of MSXML 4.0 SP2 or MSXML 6.0 installed, download and install these packages from the Microsoft Download Center. Windows Update and Microsoft Update do not offer security update 925672 if you have MSXML 4.0 or MSXML 4.0 SP1 installed. To update MSXML 4.0 or MSXML 4.0 SP1, use one of the following methods:  Method 1: Download and install security update 925672 from the Microsoft Download Center. To do this, visit the following Microsoft Web site:

http://www.microsoft.com/downloads/details.aspx?familyid=961f3c95-ec4e-4561-ab27-b3180e9139c5

</li> Method 2: Download and install MSXML 4.0 SP2, and then install security update 925672 from Windows Update or from Microsoft Update. To download MSXML 4.0 SP2, visit the following Microsoft Web site:

http://www.microsoft.com/downloads/details.aspx?familyid=3144b72b-b4f2-46da-b4b6-c5d7485f2b42

</li></ul> </li> The files that are installed by security updates 925672 and 925673 for MSXML 4.0 SP2 and MSXML 6.0 are listed in the following tables.

MSXML 6.0 is not installed

MSXML 6.0 is installed

MSXML 4.0 is not installed

Note This security update is installed in both the %SystemRoot%\System32 folder and the side-by-side folder.

MSXML 4.0 is installed

Note This security update is installed both in side-by-side mode and in %SystemRoot%\SYSTEM32.</li> When you remove security update 925673 for MSXML 6.0, MSXML 6.0 is completely removed from the computer.</li> Security update 925672 for MSXML 4.0 SP2 does not support the complete removal of MSXML 4.0 because this version of MSXML is installed in side-by-side mode. To work around this issue, follow these steps: <ol> Remove security update 925672 by using the Add or Remove Programs item in Control Panel.</li> Delete the MSXML4.dll file from the %SystemRoot%\System32 folder.</li> Repair MSXML 4.0 by using the Add or Remove Programs item in Control Panel.</li></ol>

The earlier versions of the Msxml4.dll and Msxml4r.dll files are restored to both the %SystemRoot%\System32 folder and the side-by-side folder.</li> The security update packages for MSXML 3.0 only update the MSXML3.dll file. The resource files are not updated for this version.</li> If the Msxml4.dll file is locked, the file may not be updated when you apply security update MS06-071 for MSXML 4.0, for MSXML 4.0 SP1, and for MSXML 4.0 SP2. To work around this issue, use the following commands to uninstall Msxml4.dll:   MsiExec.exe /uninstall {A9CF9052-F4A0-475D-A00F-A8388C62DD63} /passive </li>  Del %windir%\system32\msxml4.dll </li></ul> </li></ul>

Additional query words: update security_patch security_update security bug flaw vulnerability malicious attacker exploit registry unauthenticated buffer overrun overflow specially-formed scope specially-crafted denial of service DoS TSE WinNT Win2000

Keywords: kbresolve kbexpertisebeginner kbqfe kbsecurity kbsecbulletin kbsecvulnerability kbbug kbfix kbpubtypekc KB925672

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.