Aug 09 Security Updates for Standard 09 and XPe are Now Available

  • Article

The August 2009 Windows XP Embedded and Windows Embedded Standard Security Updates - Product Download is now available on the ECE for Windows® Embedded Standard 2009 and/or Microsoft® Windows® XP Embedded with Service Pack 2, Feature Pack 2007, Update Rollup 1.0 and Service Pack 3. These updates can be applied to run-times.

This download is a cumulative update which incorporates all updates from prior months. Therefore you do not need to download and install previous monthly updates. These updates can be applied directly to runtimes that include the necessary dependencies.

The August Security updates include:

  • 971633 Vulnerabilities in Microsoft DirectShow Could Allow Remote Code Execution
  • 961371 Vulnerabilities in the Embedded OpenType Font Engine Could Allow Remote Code Execution
  • 973346 Cumulative Security Update for ActiveX Killbits
  • 972260 Cumulative Security Update for Internet Explorer
  • 973908 Vulnerabilities in Microsoft Active Template Library (ATL) Could Allow Remote Code Execution This KB solution is comprised of the following KB update packages: 973354, 973507, 973540, 973815 and 973869, all included with this release.
  • 971557 Vulnerabilities in Windows Media File Processing Could Allow Remote Code Execution
  • 971657 Vulnerability in Workstation Service Could Allow Elevation of Privilege
  • 960859 Vulnerability in Telnet Could Allow Remote Code Execution
  • 970927 Vulnerabilities in Remote Desktop Connection Could Allow Remote Code Execution This KB solution is comprised of the following KB update packages: 956744 for XPe UPR1, SP3 and Standard 2009, and 958470 for XPe SP2 and FP2007, all included with this release.
  • 970653 August 2009 cumulative time zone update for Microsoft Windows operating systems.
  • 971032 Vulnerability in Message Queuing Could Allow Elevation of Privilege 

For full details on the August 2009 Embedded Windows Security Updates see the ECE site:

https://ece.partners.extranet.microsoft.com/ece/Embedded/Products/ProductSupplements/Embedded/XPE/XPEMonthlyUpdates/DistOEM-Jul09XPe_WESSecUpdts.htm

Additional Details:

In Odd numbered months, the Security Supplement Update CD contains the Security DQI updates for just that current month, and cumulative Component Database updates in the \Windows folder for each supported Embedded version (SP2, Feature Pack 2007 or Update Rollup 1.0) through the previous even numbered month. In Even numbered months, the Security Supplement Update CD contains the Security DQI updates for just that current month, and the cumulative Component Database updates for each supported Embedded version, which are updated to include the previous odd numbered month, and the current even numbered month updates.

If you are servicing your existing development environment:

On the Embedded Security Supplement Update CD in the \Windows folder, there is a Component Database Update available for each supported Embedded product version (SP2, FP2007, UPR1). If you install the Component Database update applicable to the product version you are using, your database will be current with security updates up to and including the most current even month’s security updates.

If you are servicing deployed images:

Assuming you had the cumulative Component Database updates applied to your development environment  on your image creation date, you need only deliver the DQI updates for each month following your release date and have them applied directly to the image ­or you can update your development environment as described above, and deliver a new image for re-deployment. There may be other methods you employ for servicing your images, these are the two most basic approaches you can take with the updates we provide.

If you are a new developer installing XP Embedded for the first time:

Install XP Embedded up to the product version you wish to use (SP2, Feature Pack 2007 or Update Rollup 1.0). Then install the cumulative Database Component updates provided for that version from the latest Security Supplement Update CD to bring your database up to date with all security updates up to the most recent even numbered month.

Miscellaneous Optional updates:

You will also see other updates available on the ECE which are Optional Updates. These may or may not be applicable to your image and you can review the release notes for applicability to determine if you wish to implement them. These may be provided in DQI format, Component Database update format, or both.

Note:

The Security Supplement Updates were called just Supplement Updates through October 2007, when the name changed to Security Supplement Updates.

If you have questions on accessing the ECE, please email MS Mobile & Embedded Communications Feedback & Support, ECE@microsoft.com.

Thanks,

- Patrick

Technorati Tags: XPe,Standard 2009