Export (0) Print
Expand All
This topic has not yet been rated - Rate this topic

Microsoft Security Bulletin MS09-004 - Important

Vulnerability in Microsoft SQL Server Could Allow Remote Code Execution (959420)

Published: February 10, 2009 | Updated: March 18, 2009

Version: 1.2

General Information

Executive Summary

This security update resolves a privately reported vulnerability in Microsoft SQL Server. The vulnerability could allow remote code execution if untrusted users access an affected system or if a SQL injection attack occurs to an affected system. Systems with SQL Server 7.0 Service Pack 4, SQL Server 2005 Service Pack 3, and SQL Server 2008 are not affected by this issue.

This security update is rated Important for supported releases of SQL Server 2000, SQL Server 2005 Service Pack 2, Microsoft SQL Server 2000 Desktop Engine (MSDE 2000), SQL Server 2005 Express Edition, Microsoft SQL Server 2000 Desktop Engine (WMSDE), and Windows Internal Database (WYukon). For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses the vulnerability by validating input parameters passed to an extended stored procedure. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

This security update also addresses the vulnerability first described in Microsoft Security Advisory 961040.

Recommendation. Microsoft recommends that customers apply the update at the earliest opportunity.

Known Issues. Microsoft Knowledge Base Article 959420 documents the currently known issues that customers may experience when installing this security update. The article also documents recommended solutions for these issues.

Affected and Non-Affected Software

The following software have been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, visit Microsoft Support Lifecycle.

SQL Server

GDR Software UpdatesQFE Software UpdatesMaximum Security ImpactAggregate Severity RatingBulletins Replaced by this Update
SQL Server 2000 Service Pack 4
(KB960082)
SQL Server 2000 Service Pack 4
(KB960083)
Remote Code ExecutionImportant MS08-040
SQL Server 2000 Itanium-based Edition Service Pack 4
(KB960082)
SQL Server 2000 Itanium-based Edition Service Pack 4
(KB960083)
Remote Code ExecutionImportant MS08-040
SQL Server 2005 Service Pack 2
(KB960089)
SQL Server 2005 Service Pack 2
(KB960090)
Remote Code ExecutionImportant MS08-052
SQL Server 2005 x64 Edition Service Pack 2
(KB960089)
SQL Server 2005 x64 Edition Service Pack 2
(KB960090)
Remote Code ExecutionImportant MS08-052
SQL Server 2005 with SP2 for Itanium-based Systems
(KB960089)
SQL Server 2005 with SP2 for Itanium-based Systems
(KB960090)
Remote Code ExecutionImportant MS08-052
Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) Service Pack 4
(KB960082)
Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) Service Pack 4
(KB960083)
Remote Code ExecutionImportant MS08-040
SQL Server 2005 Express Edition Service Pack 2
(KB960089)
SQL Server 2005 Express Edition Service Pack 2
(KB960090)
Remote Code ExecutionImportant MS08-052
SQL Server 2005 Express Edition with Advanced Services Service Pack 2
(KB960089)
SQL Server 2005 Express Edition with Advanced Services Service Pack 2
(KB960090)
Remote Code ExecutionImportant MS08-052

Windows Components

Operating SystemComponentMaximum Security ImpactAggregate Severity RatingBulletins Replaced by this Update
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 Microsoft SQL Server 2000 Desktop Engine (WMSDE)
(KB960082)
Remote Code ExecutionImportant MS08-040
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 Windows Internal Database (WYukon) Service Pack 2
(KB960089)
Remote Code ExecutionImportant MS08-040
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 Microsoft SQL Server 2000 Desktop Engine (WMSDE)
(KB960082)
Remote Code ExecutionImportant MS08-040
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 Windows Internal Database (WYukon) x64 Edition Service Pack 2
(KB960089)
Remote Code ExecutionImportant MS08-040
Windows Server 2008 for 32-bit Systems* Windows Internal Database (WYukon) Service Pack 2
(KB960089)
Remote Code ExecutionImportant MS08-040
Windows Server 2008 for x64-based Systems* Windows Internal Database (WYukon) x64 Edition Service Pack 2
(KB960089)
Remote Code ExecutionImportant MS08-040

*Windows Server 2008 server core installation affected. For supported editions of Windows Server 2008, this update applies, with the same severity rating, whether or not Windows Server 2008 was installed using the Server Core installation option. For more information on this installation option, see Server Core. Note that the Server Core installation option does not apply to certain editions of Windows Server 2008; see Compare Server Core Installation Options.

Non-Affected Software

SoftwareComponent
SQL Server 7.0 Service Pack 4Not applicable
Microsoft Data Engine (MSDE) 1.0 Service Pack 4Not applicable
SQL Server 2005 Service Pack 3Not applicable
Application Center 2000 Service Pack 2Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) Service Pack 3a
SQL Server 2005 x64 Edition Service Pack 3Not applicable
SQL Server 2005 with SP3 for Itanium-based SystemsNot applicable
SQL Server 2008 (32-bit editions)Not applicable
SQL Server 2008 (x64-based editions)Not applicable
SQL Server 2008 (Itanium-based editions)Not applicable

Why was this bulletin revised on March 5, 2009? 
Microsoft revised this bulletin to announce a detection logic change to the update packages for Microsoft SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 (KB960082) and on Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 (KB960082). The detection logic change fixes an installation issue that would result in a failure for the Microsoft SQL Server 2000 Desktop Engine (WMSDE) update on systems with the Active Directory Migration Tool (ADMT) or Automated Deployment Services (ADS) installed. This is a deployment change only that does not affect the files contained in the initial update. Customers who have successfully updated their systems do not need to reinstall this update.

Where are the file information details? 
The file information details can be found in Microsoft Knowledge Base Article 959420.

There are both GDR and QFE updates offered for my version of SQL. How do I know which update to use? 
First, determine your SQL Server version number. For more information on determining your SQL Server version number, see Microsoft Knowledge Base Article 321185.

Second, in the table below, locate the version range that your SQL Server version number falls within. The corresponding update is the update you need to install.

Note If your SQL Server version number does not fall within any of the ranges in the table below, your SQL Server version is no longer supported. Please upgrade to the latest Service Pack or SQL Server product in order to apply this and future security updates.

SQL Server Version Range
8.00.2039-8.00.2054 8.00.2148-8.00.2281 9.00.3042-9.00.3076 9.00.3150-9.00.3310
SQL Server
SQL Server 2000 GDR and MSDE 2000
(KB960082)
SQL Server 2000 QFE and MSDE 2000
(KB960083)
SQL Server 2005 GDR
(KB960089)
SQL Server 2005 QFE
(KB960090)

For additional installation instructions, see the Security Update Information subsection for your SQL Server edition in the Update Information section.

Will the update be offered to SQL Server clusters? 
Yes. The update will also be offered to SQL Server 2000 and SQL Server 2005 instances that are clustered. Updates for SQL Server clusters will require user interaction.

If your SQL Server 2000 or SQL Server 2005 cluster has a passive node, Microsoft recommends that you scan and apply the update to the active node first, and then scan and apply to the passive node. When all components have been updated on the passive node, the update will no longer be offered.

The reference tables for SQL Server 2000 and MSDE 2000 in the Security Update Information section show that some updates may require a restart. How can I tell if my update will require a restart? 
For SQL Server 2000 and MSDE 2000, it is possible to have dependent services. Dependent services are not restarted after the service they are dependent on is stopped and restarted. For this reason, a restart should be performed after a successful install to ensure that dependent services are started. For more information on determining whether you are running dependent services, see Microsoft Knowledge Base Article 953741.

Will the updates be applied to disabled instances of SQL Server 2000, MSDE 2000, and SQL Server 2005? 
No. Only those instances of SQL Server 2000, MSDE 2000, and SQL Server 2005 that do not have a Startup type of disabled will be updated by the installer. For more information on disabled services, see Microsoft Knowledge Base Article 953740.

I am using an older version of the soft ware discussed in this security bulletin. What should I do? 
The affected software listed in this bulletin have been tested to determine which versions or editions are affected. Other versions or editions are past their support life cycle. To determine the support life cycle for your software version or edition, visit Microsoft Support Lifecycle.

It should be a priority for customers who have older versions or editions of the software to migrate to supported versions or editions to prevent potential exposure to vulnerabilities. For more information about the Windows Product Lifecycle, visit Microsoft Support Lifecycle. For more information about the extended security update support period for these software versions or editions, visit Microsoft Product Support Services.

Customers who require custom support for older software must contact their Microsoft account team representative, their Technical Account Manager, or the appropriate Microsoft partner representative for custom support options. Customers without an Alliance, Premier, or Authorized Contract can contact their local Microsoft sales office. For contact information, visit Microsoft Worldwide Information, select the country, and then click Go to see a list of telephone numbers. When you call, ask to speak with the local Premier Support sales manager. For more information, see the Windows Operating System Product Support Lifecycle FAQ.

Vulnerability Information

The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the February bulletin summary. For more information, see Microsoft Exploitability Index.

Vulnerability Severity Rating and Maximum Security Impact by Affected Software
Affected SoftwareSQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability - CVE-2008-5416Aggregate Severity Rating
SQL Server
SQL Server 2000 Service Pack 4 Important
Remote Code Execution
Important
SQL Server 2000 Itanium-based Edition Service Pack 4 Important
Remote Code Execution
Important
SQL Server 2005 Service Pack 2 Important
Remote Code Execution
Important
SQL Server 2005 x64 Edition Service Pack 2 Important
Remote Code Execution
Important
SQL Server 2005 with SP2 for Itanium-based Systems Important
Remote Code Execution
Important
Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) Service Pack 4 Important
Remote Code Execution
Important
SQL Server 2005 Express Edition Service Pack 2 Important
Remote Code Execution
Important
SQL Server 2005 Express Edition with Advanced Services Service Pack 2 Important
Remote Code Execution
Important
Windows Components
Microsoft SQL Server 2000 Desktop Engine (WMSDE) Important
Remote Code Execution
Important
Windows Internal Database (WYukon) Service Pack 2 Important
Remote Code Execution
Important
Windows Internal Database (WYukon) x64 Edition Service Pack 2 Important
Remote Code Execution
Important

A remote code execution vulnerability exists in the way that SQL Server checks parameters in the "sp_replwritetovarbin" extended stored procedure. The vulnerability could allow remote code execution if untrusted users have access to an affected system or if a SQL injection vulnerability exists on an affected system. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts.

To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2008-5416.

Mitigating Factors for SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability - CVE-2008-5416

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

  • This issue does not affect supported editions of Microsoft SQL Server 7.0 Service Pack 4, Microsoft SQL Server 2005 Service Pack 3, and Microsoft SQL Server 2008.
  • This vulnerability is not exposed anonymously. An attacker would need to either authenticate to exploit the vulnerability or take advantage of a SQL injection vulnerability in a Web application that is able to authenticate.
  • By default, MSDE 2000 and SQL Server 2005 Express do not allow remote connections. An authenticated attacker would need to initiate the attack locally to exploit the vulnerability.

Workarounds for SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability - CVE-2008-5416

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

  • Deny permissions on the sp_replwritetovarbin extended stored procedure

    Use one of the following procedures:

    To deny access to the stored procedure, connect to SQL Server as a sysadmin using osql.exe or sqlcmd.exe or through SQL Server Management Studio and execute the following T-SQL script:

    use master
    deny execute on sp_replwritetovarbin to public

    To deny access to the stored procedure using SQL Server administration:

    For SQL Server 2000:

    1. Connect to SQL Server using Enterprise Manager as a sysadmin
    2. From the SQL Server Enterprise Manager window, select the desired server
    3. Expand the databases
    4. Expand Master
    5. Click Extended Stored Procedures. A list of stored procedures appears.
    6. From the list of stored procedures, right-click sp_replwritetovarbin and select Properties
    7. In the Properties window, click Permissions
    8. Under Users/Database Roles/Public, find Public, then click the box in the EXEC column. The box turns into a red X.
    9. Click OK twice

    For SQL Server 2005:

    1. Connect to SQL Server using SQL Server Management Studio as a sysadmin
    2. From the Object Explorer window, select the desired server
    3. Expand the databases and the system databases
    4. Expand Master
    5. Expand Programmability
    6. Click Extended Stored Procedures. A list of stored procedures appears.
    7. From the list of stored procedures, right-click sp_replwritetovarbin and select Properties
    8. In the Properties window, click Permissions
    9. Click Deny execution beside the desired user IDs and click OK

    To apply the workaround to all running instances of SQL Server on a local computer, a VB script is available and has been previously provided in Microsoft Knowledge Base Article 961040.

    Impact of Wo rkaround: Disabling the sp_replwritetovarbin extended stored procedure prevents updates to subscription tables by all users. The impact of this workaround only affects customers that use transactional replication with updatable subscriptions. Customers using transactional replication with read-only subscriptions, bi-directional transactional replication, or peer-to-peer transactional replication are not impacted. For more information on transactional replication with updatable subscriptions, see MSDN.

    How to undo the workaround

    Connect to SQL Server as a sysadmin using osql.exe or sqlcmd.exe or through SQL Server Management Studio and execute the following T-SQL script:

    use master
    grant execute on sp_replwritetovarbin to public

    To restore access to the stored procedure via SQL Server administration:

    For SQL Server 2000:

    1. Connect to SQL Server using Enterprise Manager as a sysadmin
    2. From the SQL Server Enterprise Manager window, select the desired server
    3. Expand the databases
    4. Expand Master
    5. Click Extended Stored Procedures. A list of stored procedures appears.
    6. From the list of stored procedures, right-click sp_replwritetovarbin and select Properties
    7. In the Properties window, click Permissions
    8. Under Users/Database Roles/Public, find Public, then click the box in the EXEC column. The box turns into a green checkmark.
    9. Click OK twice

    For SQL Server 2005:

    1. Connect to SQL Server using SQL Server Management Studio as a sysadmin
    2. From the Object Explorer window, select the desired server
    3. Expand the databases and the system databases
    4. Expand Master
    5. Expand Programmability
    6. Click Extended Stored Procedures. A list of stored procedures appears.
    7. From the list of stored procedures, right-click sp_replwritetovarbin and select Properties
    8. In the Properties window, click Permissions
    9. Click Grant execution beside the desired user IDs and click OK

FAQ for SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability - CVE-2008-5416

What is the scope of the vulnerability? 
This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability? 
An authenticated remote code execution vulnerability exists in the MSSQL extended stored procedure, "sp_replwritetovarbin," due to an invalid parameter check.

What is the sp_replwritetovarbin extended stored procedure used for? 
The sp_replwritetovarbin extended stored procedure is used by transactional replication with updatable subscribers and only when the subscription is created with @update_mode = 'failover' or 'queued tran'.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could run arbitrary code. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

How could an attacker exploit the vulnerability? 
An attacker could create a query that calls the vulnerable extended stored procedure with an invalid parameter, causing the heap to overflow, allowing code execution.

What systems are primarily a t risk from the vulnerability? 
Servers configured to allow untrusted users to load and execute queries are at most risk from exploitation of this vulnerability.

Clients and applications that utilize MSDE 2000 or SQL Server 2005 Express are at risk of remote attack if they have modified the default installation to accept remote connections, if they allow untrusted users access to MSDE 2000 or SQL Server 2005 Express, or if an application that uses MSDE 2000 or SQL Server 2005 Express has a SQL Injection vulnerability.

All systems running one of the affected versions of Microsoft SQL Server software where a malicious user is allowed to log on are at risk of exploitation of this vulnerability. In addition, Web applications with a SQL Server back-end database are at risk if a SQL Injection vulnerability exists. For more information on SQL Injection, see Microsoft Security Advisory 954462.

What does the update do? 
The update eliminates the vulnerability by correctly validating the input parameters passed to the extended stored procedure.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CVE-2008-5416. This vulnerability was first described in Microsoft Security Advisory 961040.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had seen examples of proof of concept code published publicly but had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Update Information

Manage the software and security updates you need to deploy to the servers, desktop, and mobile systems in your organization. For more information see the TechNet Update Management Center. The Microsoft TechNet Security Web site provides additional information about security in Microsoft products.

Security updates are available from Microsoft Update, Windows Update, and Office Update. Security updates are also available from the Microsoft Download Center. You can find them most easily by doing a keyword search for "security update."

Finally, security updates can be downloaded from the Microsoft Update Catalog. The Microsoft Update Catalog provides a searchable catalog of content made available through Windows Update and Microsoft Update, including security updates, drivers and service packs. By searching using the security bulletin number (such as, “MS07-036”), you can add all of the applicable updates to your basket (including different languages for an update), and download to the folder of your choosing. For more information about the Microsoft Update Catalog, see the Microsoft Update Catalog FAQ.

Detection and Deployment Guidance

Microsoft has provided detection and deployment guidance for this month’s security updates. This guidance will also help IT professionals understand how they can use various tools to help deploy the security update, such as Windows Update, Microsoft Update, Office Update, the Microsoft Baseline Security Analyzer (MBSA), the Office Detection Tool, Microsoft Systems Management Server (SMS), and the Extended Security Update Inventory Tool. For more information, see Microsoft Knowledge Base Article 910723.

Microsoft Baseline Security Analyzer

Microsoft Baseline Security Analyzer (MBSA) allows administrators to scan local and remote systems for missing security updates as well as common security misconfigurations. For more information about MBSA, visit Microsoft Baseline Security Analyzer.

The following table provides the MBSA detection summary for this security update.

Software MBSA 2.1
SQL Server 2000 Service Pack 4Yes
SQL Server 2000 Itanium-based Edition Service Pack 4Yes
SQL Server 2005 Service Pack 2Yes
SQL Server 2005 x64-based Edition Service Pack 2Yes
SQL Server 2005 with SP2 for Itanium-based SystemsYes
Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) Service Pack 4Yes
SQL Server 2005 Express Edition Service Pack 2Yes
SQL Server 2005 Express Edition with Advanced Services Service Pack 2Yes
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2Yes
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2Yes
Windows Server 2008 and Windows Server 2008 for x64-based SystemsYes

For more information about MBSA 2.1, see MBSA 2.1 Frequently Asked Questions.

Windows Server Update Services

By using Windows Server Update Services (WSUS), administrators can deploy the latest critical updates and security updates for Windows 2000 operating systems and later, Office XP and later, Exchange Server 2003, and SQL Server 2000. For more information about how to deploy this security update using Windows Server Update Services, visit the Windows Server Update Services Web site.

Systems Management Server

The following table provides the SMS detection and deployment summary for this security update.

SoftwareSMS 2.0SMS 2003 with SUSFPSMS 2003 with ITMUConfiguration Manager 2007
SQL Server 2000 Service Pack 4NoNoYesYes
SQL Server 2000 Itanium-based Edition Service Pack 4NoNoYesYes
SQL Server 2005 Service Pack 2NoNoYesYes
SQL Server 2005 x64-based Edition Service Pack 2NoNoYesYes
SQL Server 2005 with SP2 for Itanium-based SystemsNoNoYesYes
Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) Service Pack 4NoNoYesYes
SQL Server 2005 Express Edition Service Pack 2NoNoYesYes
SQL Server 2005 Express Edition with Advanced Services Service Pack 2NoNoYesYes
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2NoNoYesYes
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2NoNoYesYes
Windows Server 2008 and Windows Server 2008 for x64-based SystemsNoNoSee Note for Windows Server 2008 belowYes

For SMS 2.0 and SMS 2003, the SMS SUS Feature Pack (SUSFP), which includes the Security Update Inventory Tool (SUIT), can be used by SMS to detect security updates. See also Downloads for Systems Management Server 2.0.

For SMS 2003, the SMS 2003 Inventory Tool for Microsoft Updates (ITMU) can be used by SMS to detect security updates that are offered by Microsoft Update and that are supported by Windows Server Update Services. For more information about the SMS 2003 ITMU, see SMS 2003 Inventory Tool for Microsoft Updates. SMS 2003 can also use the Microsoft Office Inventory Tool to detect required updates for Microsoft Office applications. For more information about the Office Inventory Tool and other scanning tools, see SMS 2003 Software Update Scanning Tools. See also Downloads for Systems Management Server 2003.

System Center Configuration Manager 2007 uses WSUS 3.0 for detection of updates. For more information about Configuration Manager 2007 Software Update Management, visit System Center Configuration Manager 2007.

Note fo r Windows Server 2008 Microsoft Systems Management Server 2003 with Service Pack 3 includes support for Windows Server 2008 manageability.

For more information about SMS, visit the SMS Web site.

For more detailed information, see Microsoft Knowledge Base Article 910723: Summary list of monthly detection and deployment guidance articles.

Update Compatibility Evaluator and Application Comp atibility Toolkit

Updates often write to the same files and registry settings required for your applications to run. This can trigger incompatibilities and increase the time it takes to deploy security updates. You can streamline testing and validating Windows updates against installed applications with the Update Compatibility Evaluator components included with Application Compatibility Toolkit 5.0.

The Application Compatibility Toolkit (ACT) contains the necessary tools and documentation to evaluate and mitigate application compatibility issues before deploying Microsoft Windows Vista, a Windows Update, a Microsoft Security Update, or a new version of Windows Internet Explorer in your environment.

Affected Software

For information about the specific security update for your affected software, click the appropriate link:

SQL Server 2000 and Microsoft SQL Server Desktop Engine (MSDE)

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Inclusion in Future Service Packs No future service packs are planned for SQL Server 2000
Deployment
Installing without user interventionFor GDR update of SQL Server 2000 installed on all supported 32-bit and x64-based systems:
SQL2000-KB960082-v8.00.2055-x86x64-ENU /quiet /allinstances
For GDR update of all supported Itanium-based editions of SQL Server 2000:
SQL2000-KB960082-v8.00.2055-ia64-ENU /quiet /allinstances
For QFE update of SQL Server 2000 installed on all supported 32-bit and x64-based systems:
SQL2000-KB960083-v8.00.2282-x86x64-ENU /quiet /allinstances
For QFE update of all supported Itanium-based editions of SQL Server 2000:
SQL2000-KB960083-v8.00.2282-ia64-ENU /quiet /allinstances
Installing without restartingFor GDR update of SQL Server 2000 installed on all supported 32-bit and x64-based systems:
SQL2000-KB960082-v8.00.2055-x86x64-ENU /norestart /allinstances
For GDR update of all supported Itanium-based editions of SQL Server 2000:
SQL2000-KB960082-v8.00.2055-ia64-ENU /norestart /allinstances
For QFE update of SQL Server 2000 installed on all supported 32-bit and x64-based systems:
SQL2000-KB960083-v8.00.2282-x86x64-ENU /norestart /allinstances
For QFE update of all supported Itanium-based editions of SQL Server 2000:
SQL2000-KB960083-v8.00.2282-ia64-ENU /norestart /allinstances
Installing a single instanceFor GDR update of SQL Server 2000 installed on all supported 32-bit and x64-based systems:
SQL2000-KB960082-v8.00.2055-x86x64-ENU /quiet /InstanceName={instance}
For GDR update of all supported Itanium-based editions of SQL Server 2000:
SQL2000-KB960082-v8.00.2055-ia64-ENU /quiet /InstanceName={instance}
For QFE update of SQL Server 2000 installed on all supported 32-bit and x64-based systems:
SQL2000-KB960083-v8.00.2282-x86x64-ENU /quiet /InstanceName={instance}
For QFE update of all supported Itanium-based editions of SQL Server 2000:
SQL2000-KB960083-v8.00.2282-ia64-ENU /quiet /InstanceName={instance}
For GDR update of SQL Server 2000 installed on all supported 32-bit and x64-based systems:
SQL2000-KB960082-v8.00.2055-x86x64-ENU /norestart /InstanceName={instance}
For GDR update of all supported Itanium-based editions of SQL Server 2000:
SQL2000-KB960082-v8.00.2055-ia64-ENU /norestart /InstanceName={instance}
For QFE update of SQL Server 2000 installed on all supported 32-bit and x64-based systems:
SQL2000-KB960083-v8.00.2282-x86x64-ENU /norestart /InstanceName={instance}
For QFE update of all supported Itanium-based editions of SQL Server 2000:
SQL2000-KB960083-v8.00.2282-ia64-ENU /norestart /InstanceName={instance}
Update log fileSQL2000-KB960082-v8.00.2055-x86-<language>.log or SQL2000-KB960083-v8.00.2282-x86-<language>.log
Special instructionsThe update will also be offered to SQL Server 2000 instances that are clustered. Updates for SQL Server 2000 clusters will require user interaction.

If your SQL Server 2000 cluster has a passive node, Microsoft recommends that you scan and apply the update to the active node first, and then scan and apply to the passive node. When all components have been updated on the passive node, the update will no longer be offered.
Further informationSee the subsection, Detection and Deployment Tools and Guidance
Restart Requirement
Restart required?A restart is recommended after the update installation to restart any dependent services. For additional information, please see "How can I tell if my update will require a restart?" in the Update FAQ section of this bulletin. If a restart is required, the installer will prompt or return exit code 3010.
HotpatchingThis security update does not support HotPatching. For more information about HotPatching, see Microsoft Knowledge Base Article 897341.
Removal Information For all supported editions of SQL Server 2000:
Use Add or Remove Programs tool in Control Panel
File Information See Microsoft Knowledge Base Article 959420

Deployment Information

Installing the Update

When you install this security update, the installer checks to see if one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
SwitchDescription
/help Displays the command-line options
Setup Modes
/passive Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.
/quie t Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart Does not restart when installation has completed
/forcerestart Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x] Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart Display a dialog box prompting the local user to allow a restart
Special Options
/overwriteoem Overwrites OEM files without prompting
/nobackup Does not back up files needed for uninstall
/forceappsclose Forces other programs to close when the computer shuts down
/log:path Allows the redirection of installation log files
/integrate:path Integrates the update into the Windows source files. These files are located at the path that is specified in the switch.
/allinstances Applies update to all instances
/InstanceName={instance} Applies update to specified instance

Note You can combine these switches into one command. For backward compatibility, the security update also supports many of the setup switches that the earlier version of the Setup program uses. For more information about the supported installation switches, see Microsoft Knowledge Base Article 262841. For more information about the Update.exe installer, visit the Microsoft TechNet Web site.

Removing the Update

This security update supports the following setup switches.

Supported Spuninst.exe Switches
SwitchDescription
/help Displays the command-line options
Setup Modes
/passive Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.
/quie t Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart Does not restart when installation has completed
/forcerestart Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x] Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart Display a dialog box prompting the local user to allow a restart
Special Options
/forceappsclose Forces other programs to close when the computer shuts down
/log:path Allows the redirection of installation log files
/allinstances Applies update to all instances
/InstanceName={instance} Applies update to specified instance

Verifying that the Update Has Been Applied

  • Microsoft Baseline Security Analyzer

    To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

  • File Version Verification

    Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

    1. Click Start, and then click Search.
    2. In the Search Results pane, click All files and folders under Search Companion.
    3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search.
    4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties.

      Note Depending on the version of the operating system or programs installed, some of the files that are listed in the file information table may not be installed.
    5. On the Version tab, determine the version of the file that is installed on your computer by comparing it to the version that is documented in the appropriate file information table.

      Note Attributes other than the file version may change during installation. Comparing other file attributes to the information in the file information table is not a supported method of verifying that the update has been applied. Also, in certain cases, files may be renamed during installation. If the file or version information is not present, use one of the other available methods to verify update installation.

SQL Server 2005 (all editions)

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Inclusion in Future Service Packs SQL Server 2005 Service Pack 3
Deployment
Installing without user interventionFor GDR update of all supported 32-bit editions of SQL Server 2005:
SQLServer2005-KB960089-x86-ENU /quiet /allinstances
For GDR update of all supported x64-based editions of SQL Server 2005:
SQLServer2005-KB960089-x64-ENU /quiet /allinstances
For GDR update of all supported Itanium-based editions of SQL Server 2005:
SQLServer2005-KB960089-IA64-ENU /quiet /allinstances
For QFE update of all supported 32-bit editions of SQL Server 2005:
SQLServer2005-KB960090-x86-ENU /quiet /allinstances
For QFE update of all supported x64-based editions of SQL Server 2005:
SQLServer2005-KB960090-x64-ENU /quiet /allinstances
For QFE update of all supported Itanium-based editions of SQL Server 2005:
SQLServer2005-KB960090-IA64-EN /quiet /allinstances
Installing a single instanceFor GDR update of all supported 32-bit editions of SQL Server 2005:
SQLServer2005-KB960089-x86-ENU /quiet /InstanceName={instance}
For GDR update of all supported x64-based editions of SQL Server 2005:
SQLServer2005-KB960089-x64-ENU /quiet /InstanceName={instance}
For GDR update of all supported Itanium-based editions of SQL Server 2005:
SQLServer2005-KB960089-IA64-ENU /quiet /InstanceName={instance}
For QFE update of all supported 32-bit editions of SQL Server 2005:
SQLServer2005-KB960090-x86-ENU /quiet /InstanceName={instance}
For QFE update of all supported x64-based editions of SQL Server 2005:
SQLServer2005-KB960090-x64-ENU /quiet /InstanceName={instance}
For QFE update of all supported Itanium-based editions of SQL Server 2005:
SQLServer2005-KB960090-IA64-ENU /quiet /InstanceName={instance}
Update log file%programfiles%\Microsoft SQL Server\90\Setup Bootstrap\LOG\Hotfix\Summary.log
Special instructionsThe update will also be offered to SQL Server 2005 instances that are clustered. Updates for SQL Server 2005 clusters will require user interaction.

If your SQL Server 2005 cluster has a passive node, Microsoft recommends that you scan and apply the update to the active node first, and then scan and apply to the passive node. When all components have been updated on the passive node, the update will no longer be offered.
Further informationSee the subsection, Detection and Deployment Tools and Guidance
Restart Requirement
Restart required?If a restart is required, the installer will prompt or return exit code 3010.
HotpatchingThis security update does not support HotPatching. For more information about HotPatching, see Microsoft Knowledge Base Article 897341.
Removal Information For all supported editions of SQL Server 2005:
Use Add or Remove Programs tool in Control Panel
File Information See Microsoft Knowledge Base Article 959420

Deployment Information

Installing the Update

When you install this security update, the installer checks to see if one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
SwitchDescription
/? Displays the Help dialog
/quiet Runs Setup in quiet mode
/reportonly Displays the features that this package can update
/allinstances Upgrades all SQL Server instances and all shared components
/instancename Upgrades a specific SQL Server instance and all shared components
/sapwd Password for the SQL Server sa account to run scripts
/user User account for connecting to a remote cluster node
/password Password for user account for connecting to a remote cluster node
/rsupgradedatabaseaccount User account for upgrading Reporting Services
/rsupgradepassword Password for user account for upgrading Reporting Services
/rsupgradedatabase Prevents the Reporting Services database from being upgraded when the parameter equals 0
/allinstances Applies update to all instances
/InstanceName={instance} Applies update to specified instance

Note You can combine these switches into one command. For backward compatibility, the security update also supports many of the setup switches that the earlier version of the Setup program uses. For more information about the supported installation switches, see Microsoft Knowledge Base Article 262841. For more information about the Update.exe installer, visit the Microsoft TechNet Web site.

Removing the Update

Example of how to remove QFE from single instance:

%windir%\SQL9_KB960090_ENU\hotfix.exe /quiet /uninstall /instancename=foo

Example of how to remove QFE from all instances:

%windir%\SQL9_KB960090_ENU\hotfix.exe /quiet /uninstall /allinstances

Verifying that the Update Has Been Applied

  • Microsoft Baseline Security Analyzer

    To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

  • File Version Verification

    Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

    1. Click Start, and then click Search.
    2. In the Search Results pane, click All files and folders under Search Companion.
    3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search.
    4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties.

      Note Depending on the version of the operating system or programs installed, some of the files that are listed in the file information table may not be installed.
    5. On the Version tab, determine the version of the file that is installed on your computer by comparing it to the version that is documented in the appropriate file information table.

      Note Attributes other than the file version may change during installation. Comparing other file attributes to the information in the file information table is not a supported method of verifying that the update has been applied. Also, in certain cases, files may be renamed during installation. If the file or version information is not present, use one of the other available methods to verify update installation.

Microsoft SQL Server 2000 Desktop Engine (WMSDE) (all editions)

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Inclusion in Future Service Packs No future service packs are planned for Microsoft SQL Server 2000 Desktop Engine (WMSDE)
Deployment
Installing without user interventionFor all supported 32-bit editions of Microsoft SQL Server 2000 Desktop Engine (WMSDE):
SQLWMSDE-KB960082-x86-ENU /quiet /upgradesp sqlrun {BLANKSAPWD=1 or SAPWD=} INSTANCENAME={instancename} /l*v %windir%<yyyyy>.log

Where:
instancename is the product instance name used during install, i.e., either “UDDI,” “SharePoint,” “WSUS,” “MS_ADMT,” or “MicrosoftADS”

For Example:
SQLWMSDE-KB960082-x86-ENU.exe /upgradesp sqlrun 1 INSTANCENAME=UDDI /l*v %windir%WMSDE.log

Basic Installation Example:
SQLWMSDE-KB960082-x86-ENU.exe SAPWD=”(administrator’s password)” INSTANCENAME=UDDI

Installing without restartingFor all supported 32-bit editions of Microsoft SQL Server 2000 Desktop Engine (WMSDE):
SQLWMSDE-KB960082-x86-ENU /norestart /upgradesp sqlrun {BLANKSAPWD=1 or SAPWD=} INSTANCENAME={instancename} /l*v %windir%<yyyyy>.log /norestart

Where:
instancename is the product instance name used during install. i.e., either “UDDI,” “SharePoint,” “WSUS,” “MS_ADMT,” or “MicrosoftADS”

For Example:
SQLWMSDE-KB960082-x86-ENU.exe /upgradesp sqlrun 1 INSTANCENAME=UDDI /l*v %windir%WMSDE.log
Update log fileKB960082.log
Further informationSee the subsection, Detection and Deployment Tools and Guidance

Note Neither an Installation Wizard nor Dialogue is available

Restart Requirement
Restart required?If a restart is required, the installer will prompt or return exit code 3010.
HotpatchingThis security update does not support HotPatching. For more information about HotPatching, see Microsoft Knowledge Base Article 897341.
Removal Information For all supported 32-bit editions of Microsoft SQL Server 2000 Desktop Engine (WMSDE):
Use Add or Remove Programs tool in Control Panel.

Note Removing this security update for WMSDE will completely remove the WMSDE instance from the system.

File Information See Microsoft Knowledge Base Article 959420

Deployment Information

Installing the Update

When you install this security update, the installer checks to see if one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
SwitchDescription
/help Displays the command-line options
Restart Options
/norestart Does not restart when installation has completed
/forcerestart Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x] Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart Display a dialog box prompting the local user to allow a restart
Special Options
/overwriteoem Overwrites OEM files without prompting
/nobackup Does not back up files needed for uninstall
/forceappsclose Forces other programs to close when the computer shuts down
/log:path Allows the redirection of installation log files
/integrate:path Integrates the update into the Windows source files. These files are located at the path that is specified in the switch.
/extract[:path] Extracts files without starting the Setup program
/ER Enables extended error reporting
/verbose Enables verbose logging. During installation, creates %Windir%\CabBuild.log. This log details the files that are copied. Using this switch may cause the installation to proceed more slowly.
/allinstances Applies update to all instances
/InstanceName={instance} Applies update to specified instance

Note You can combine these switches into one command. For backward compatibility, the security update also supports many of the setup switches that the earlier version of the Setup program uses. For more information about the supported installation switches, see Microsoft Knowledge Base Article 262841. For more information about the Update.exe installer, visit the Microsoft TechNet Web site.

Removing the Update

Note Removing this security update for WMSDE will completely remove the WMSDE instance from the system.

Uninstall commands for WMSDE:

MS_ADMT

msiexec /x {EEE5C104-B67A-486D-947E-A209F2058E93} /qn reboot=reallysupress /l*v %windir%\results\AdmtUn.log

MicrosoftADS

msiexec /x {B3E6E30F-7680-4DF9-A152-B5285098A5AD} /qn reboot=reallysupress /l*v %windir%\results\AdsUn.log

SharePoint

msiexec /x {65657C59-23A8-4974-B8E0-BA04EBD04E4F} /qn reboot=reallysupress /l*v %windir%\results\SharepointUn.log

UDDI

msiexec /x {B42339CD-9F22-4A6A-A023-D12990E0B918} /qn reboot=reallysupress /l*v %windir%\results\UddiUn.log

WSUS

msiexec /x {83BC1BC2-FCC4-4CED-8A3C-EB7CDFB3CF6A} /qn reboot=reallysupress /l*v %windir%\results\WsusUn.log

Verifying that the Update H as Been Applied

  • Microsoft Baseline Security Analyzer

    To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

  • File Version Verification

    Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

    1. Click Start, and then click Search.
    2. In the Search Results pane, click All files and folders under Search Companion.
    3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search.
    4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties.

      Note Depending on the version of the operating system or programs installed, some of the files that are listed in the file information table may not be installed.
    5. On the Version tab, determine the version of the file that is installed on your computer by comparing it to the version that is documented in the appropriate file information table.

      Note Attributes other than the file version may change during installation. Comparing other file attributes to the information in the file information table is not a supported method of verifying that the update has been applied. Also, in certain cases, files may be renamed during installation. If the file or version information is not present, use one of the other available methods to verify update installation.

Windows Internal Database (WYukon) (all editions)

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Inclusion in Future Service Packs Windows Internal Database (WYukon) Service Pack 3
Deployment
Installing without user interventionFor all supported 32-bit editions of Windows Internal Database (WYukon):
WYukon2005Setup-KB960089-x86-ENU /quiet
For all supported 64-bit editions of Windows Internal Database (WYukon):
WYukon2005Setup-KB960089-x64-ENU /quiet
Installing without restartingFor all supported 32-bit editions of Windows Internal Database (WYukon):
WYukon2005Setup-KB960089-x86-ENU /norestart
For all supported 64-bit editions of Windows Internal Database (WYukon):
WYukon2005Setup-KB960089-x64-ENU /norestart
Update log fileSSEE_10.log
Further informationSee the subsection, Detection and Deployment Tools and Guidance

Note Neither an Installation Wizard nor Dialogue is available

Restart Requirement
Restart required?Yes, you must restart your system after you apply this security update
HotpatchingThis security update does not support HotPatching. For more information about HotPatching, see Microsoft Knowledge Base Article 897341.
Removal Information For all supported editions of Windows Internal Database (WYukon):
Use Add or Remove Programs tool in Control Panel.

Note Removing this security update for WYukon will completely remove the WYukon instance from the system. WYukon shows in Add or Remove Programs as “Windows Internal Database”

File Information See Microsoft Knowledge Base Article 959420

Deployment Information

Installing the Update

When you install this security update, the installer checks to see if one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
SwitchDescription
/help Displays the command-line options
Restart Options
/norestart Does not restart when installation has completed
/forcerestart Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x] Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart Display a dialog box prompting the local user to allow a restart
Special Options
/overwriteoem Overwrites OEM files without prompting
/nobackup Does not back up files needed for uninstall
/forceappsclose Forces other programs to close when the computer shuts down
/log:path Allows the redirection of installation log files
/integrate:path Integrates the update into the Windows source files. These files are located at the path that is specified in the switch.
/extract[:path] Extracts files without starting the Setup program
/ER Enables extended error reporting
/verbose Enables verbose logging. During installation, creates %Windir%\CabBuild.log. This log details the files that are copied. Using this switch may cause the installation to proceed more slowly.

Note You can combine these switches into one command. For backward compatibility, the security update also supports many of the setup switches that the earlier version of the Setup program uses. For more information about the supported installation switches, see Microsoft Knowledge Base Article 262841. For more information about the Update.exe installer, visit the Microsoft TechNet Web site.

Verifying that the Update Has Been Applied

  • Microsoft Baseline Security Analyzer

    To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

  • File Version Verification

    Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

    1. Click Start, and then click Search.
    2. In the Search Results pane, click All files and folders under Search Companion.
    3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search.
    4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties.

      Note Depending on the version of the operating system or programs installed, some of the files that are listed in the file information table may not be installed.
    5. On the Version tab, determine the version of the file that is installed on your computer by comparing it to the version that is documented in the appropriate file information table.

      Note Attributes other than the file version may change during installation. Comparing other file attributes to the information in the file information table is not a supported method of verifying that the update has been applied. Also, in certain cases, files may be renamed during installation. If the file or version information is not present, use one of the other available methods to verify update installation.

Other Information

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

  • Bernhard Mueller of SEC Consult Vulnerability Lab for reporting the SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability (CVE-2008-5416)

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections Web sites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.

Support

  • Customers in the U.S. and Canada can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates.
  • International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit the International Support Web site.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

  • V1.0 (February 10, 2009): Bulletin published.
  • V1.1 (March 5, 2009): Added entry to section, Frequently Asked Questions (FAQ) Related to This Security Update, announcing a detection logic change to the update packages for Microsoft SQL Server 2000 Desktop Engine (WMSDE) (KB960082). This is a deployment change only that does not affect the files contained in the initial update. Customers who have successfully updated their systems do not need to reinstall this update.
  • V1.2 (March 18, 2009): Corrected product instance names from "ADMT" and "ADS" to "MS_ADMT" and "MicrosoftADS", respectively. These are instance names referenced in the Security Update Deployment section for the Microsoft SQL Server 2000 Desktop Engine (WMSDE). This is an informational change only that does not affect the files contained in the update. Customers who have successfully updated their systems do not need to reinstall this update.

Built at 2014-04-18T13:49:36Z-07:00

Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft. All rights reserved.