Article ID: 903675
Article Last Modified on 10/27/2006
APPLIES TO
- Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
- Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
- Microsoft Windows Server 2003, Standard Edition (32-bit x86)
- Microsoft Windows Server 2003, Web Edition
- Microsoft Windows XP Service Pack 2, when used with:
- Microsoft Windows XP Professional
- Microsoft Windows XP Home Edition
- Microsoft Windows XP Service Pack 1, when used with:
- Microsoft Windows XP Professional
- Microsoft Windows XP Home Edition
- Microsoft Windows 2000 Service Pack 4, when used with:
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Datacenter Server
- Microsoft Windows 2000 Professional Edition
- Microsoft Windows 2000 Server
SUMMARY
Microsoft is providing this detection and deployment guidance for all updates that are released as part of the security release that is dated July 12, 2005. This guidance covers environments that use the following tools to detect and to deploy security updates:
- Microsoft Windows Update, Microsoft Update, and Office Update
- Versions 1.2.1 and 2.0 of the Microsoft Baseline Security Analyzer (MBSA)
- Software Update Services (SUS) or Windows Server Update Services (WSUS)
- Microsoft Systems Management Server (SMS) together with the Software Update Services Feature Pack and with the Extended Security Update Inventory Tool
INTRODUCTION
This article includes detection and deployment guidance for the security release that is dated July 12, 2005.
As part of an ongoing commitment to provide detection tools and deployment recommendations for security updates, Microsoft is providing this guidance for all updates that are released during a Microsoft Security Response Center (MSRC) release cycle. This guidance contains recommendations that are based on the types of scenarios that may exist in various Microsoft operating system environments. This guidance includes the use of tools such as Windows Update, Office Update, the Microsoft Baseline Security Analyzer (MBSA), the Office Detection Tool, Microsoft Systems Management Server (SMS), the Extended Security Update Inventory Tool, and the Enterprise Update Scan Tool (EST).
MORE INFORMATION
Detection and deployment
Environments that use Microsoft Windows Update, Microsoft Update, and Office Update to detect and to deploy security updates
Most of the updates that were released on July 12, 2005 are available through the following Web sites:
- Windows Update
- Microsoft Update
- Office Update
However, these Web sites do not detect or only partially support the following updates:
- Security update 896428 is an update for telnet. Telnet is included with Microsoft Windows Server 2003 and with Microsoft Windows XP. Telnet is also included with versions 2.0, 2.1, 2.2, 3.0 and 3.5 of Microsoft Windows Services for UNIX. The rerelease of this update supports versions 2.0 and 2.1 of Windows Services for UNIX. These services were determined to be vulnerable after the original release of this update. Windows Update and Microsoft Update support the detection and deployment of this update only for the version of telnet that is included with the following operating systems:
- Windows Server 2003 with Service Pack 1 (SP1)
- Windows Server 2003
- Windows XP with Service Pack 2 (SP2)
- Windows XP with Service Pack 1 (SP1)
Environments that use versions 1.2.1 and 2.0 of MBSA to detect security updates
If you use versions 1.2.1 or 2.0 of the Microsoft Baseline Security Analyzer (MBSA) to detect security updates, you can detect most of the updates that were released on July 12, 2005. The following list details which version of MBSA will detect which updates:
- Security update 896428 is an update for telnet. Telnet is included with Microsoft Windows Server 2003 and with Microsoft Windows XP. Telnet is also included with versions 2.0, 2.1, 2.2, 3.0 and 3.5 of Microsoft Windows Services for UNIX. The rerelease of this update supports versions 2.0 and 2.1 of Windows Services for UNIX. These services were determined to be vulnerable after the original release of this update. Versions 1.2.1 and 2.0 of MBSA support only the versions of telnet that are included with the following operating systems:
- Windows Server 2003 with SP1
- Windows Server 2003
- Windows XP with SP2
- Windows XP with SP1
Versions 1.2.1 and 2.0 of MBSA do not support the version of telnet that is included with Windows Services for UNIX. You can use the Enterprise Update Scan Tool to detect this update when telnet was installed by versions 2.0, 2.1, 2.2, 3.0, or 3.5 of Windows Services for UNIX. You can install Windows Services for UNIX on the following operating systems:
- Windows Server 2003 with SP1
- Windows Server 2003
- Windows XP with SP2
- Windows XP with SP1
- Windows 2000 with SP4
- Windows 2000 with SP3
For more information about how to obtain the Enterprise Update Scan Tool, click the following article number to view the article in the Microsoft Knowledge Base:
894193 How to obtain and use the Enterprise Update Scan Tool
Environments that use Software Update Services or Windows Server Update Services to detect and to deploy security updates
If you use Microsoft Software Update Services (SUS) or Microsoft Windows Server Update Services (WSUS) to detect and to deploy security updates, you can detect most of the updates that were released on July 12, 2005. However, SUS and WSUS do not detect or only partially support the following updates:
- Security update 896428 is an update for telnet. Telnet is included with Microsoft Windows Server 2003 and with Microsoft Windows XP. Telnet is also included with versions 2.0, 2.1, 2.2, 3.0 and 3.5 of Microsoft Windows Services for UNIX. The rerelease of this update supports versions 2.0 and 2.1 of Windows Services for UNIX. These services were determined to be vulnerable after the original release of this update. SUS and WSUS support only the versions of telnet that are included with the following operating systems:
- Windows Server 2003 with SP1
- Windows Server 2003
- Windows XP with SP2
- Windows XP with SP1
Environments that use SMS together with the Software Update Services Feature Pack and with the Extended Security Update Inventory Tool to detect and to deploy security updates
If you use Microsoft Systems Management Server (SMS) to detect and to deploy security updates, you can detect all the security updates that were released on July 12, 2005. However, you can fully detect some of the security updates only by using the latest cumulative Extended Security Update Inventory Tool. To obtain this tool, visit the following Microsoft Web site:
Summary of detection and deployment guidance
New security updates
The following table summarizes the detection and deployment guidance for each new security update.
| Office Update | Windows Update | Microsoft Update | The MBSA 1.2 and the Office Detection Tool | MBSA 2.0 | SUS | WSUS | The stand-alone Enterprise Update Scan Tool | SMS with the SUS Feature Pack | |
| Security update/Bulletin | Detect and deploy | Detect and deploy | Detect and deploy | Detect only | Detect only | Detect and deploy | Detect and deploy | Detect only | Detect and deploy |
| 895333/MS05-035 Word | Yes | N/A | Yes | Yes | Yes | N/A | Yes | N/A | Yes |
| 901214/MS05-036 CMM | N/A | Yes | Yes | Yes | Yes | Yes | Yes | N/A | Yes |
| 903144/MS05-037 | N/A | Yes | Yes | Yes | Yes | Yes | Yes | N/A | Yes |
Rereleased security updates
The following table summarizes the detection and deployment guidance for each re-released security update.
| Office Update | Windows Update | Microsoft Update | The MBSA 1.2 and the Office Detection Tool | MBSA 2.0 | SUS | WSUS | The stand-alone Enterprise Update Scan Tool | SMS with the SUS Feature Pack | |
| Security update/Bulletin | Detect and deploy | Detect and deploy | Detect and deploy | Detect only | Detect only | Detect and deploy | Detect and deploy | Detect only | Detect and deploy |
| 896428/MS05-033 Telnet | N/A | Partially supported | Partially supported | Partially supported | Partially supported | Partially supported | Partially supported | Partially supported | Yes |
Frequently asked questions
What is Microsoft doing to provide guidance about how to deploy these updates?
Microsoft encourages system administrators to join the monthly technical webcast to learn more about security updates. The webcast for these security update airs on July 13, 2005 at 11:00 A.M. Pacific Time. To register, visit the following Microsoft Web site:
Is the Enterprise Update Scan Tool cumulative, as the Extended Security Update Inventory Tool is for SMS?
No, the Enterprise Update Scan tool is not cumulative. There are no plans to make the Enterprise Update Scan tool cumulative.
Can I use the Microsoft Baseline Security Analyzer (MBSA) tool to determine whether updates are required?
You can use versions 1.2.1 and 2.0 of MBSA to detect the following security updates that were released in July, 2005:
- 895333
- 901214
- 903144
Versions 1.2.1 and 2.0 of MBSA partially support the following security update:
- 896428
For more information, see the "Environments that use versions 1.2.1 and 2.0 of MBSA to detect security updates" section.
For more information about the programs that the MBSA currently does not detect, click the following article numbers to view the articles in the Microsoft Knowledge Base:
306460 Microsoft Baseline Security Analyzer 1.2.1(MBSA) returns note messages for some updates
895660 Microsoft Baseline Security Analyzer 2.0 is Available
If you have installed a program that is listed in the "Affected software" section of a security bulletin, you may have to manually determine whether you must install the security update. For more information about MBSA, visit the following Microsoft Web site:
Which security updates require that I use the Enterprise Update Scan Tool together with MBSA to identify vulnerable systems on my network?
The following security update is partially supported by the Enterprise Update Scan Tool together with the MBSA under certain conditions:
- 896428
For more information, see the "Environments that use versions 1.2.1 and 2.0 of MBSA to detect security updates" section.
Can I use Systems Management Server (SMS) to determine whether these updates are required?
Yes. SMS helps detect and deploy these security updates. However, because SMS uses MBSA to detect updates, SMS does not detect updates that MBSA does not detect. For more information about SMS, visit the following Microsoft Web site:
To detect all the security updates on Microsoft Windows and on other affected Microsoft products, the Security Update Inventory Tool and the Extended Security Update Inventory Tool are both required.
For more information about the limitations of the Security Update Inventory Tool, click the following article number to view the article in the Microsoft Knowledge Base:
306460 Microsoft Baseline Security Analyzer (MBSA) returns note messages for some updates
SMS also uses the Microsoft Office Inventory Tool to detect the required security updates for Microsoft Office programs such as Microsoft Word.
Keywords: kbexpertiseadvanced kbsecurity kbhowto kbinfo KB903675
