The December 2009 Security Updates For Runtimes Are Now Available on the ECE

  • Article

The December 2009 Windows XP Embedded and Windows Embedded Standard 2009 Security Updates - Product Download is now available on the ECE for Windows® Embedded Standard 2009 (WES 2009) and/or Microsoft® Windows® XP Embedded (XPe) with Service Pack 2, Feature Pack 2007, Update Rollup 1.0 and Service Pack 3.

This download is a cumulative update which incorporates all updates from prior months. Therefore you do not need to download and install previous monthly updates. These updates can be applied directly to runtimes that include the necessary dependencies.

The December Security updates include:

  • KB 976098 - December 2009 cumulative time zone update for Microsoft Windows operating systems 
  • KB 974392 - Vulnerability in Local Security Authority Subsystem Service Could Allow Denial of Service
  • KB 974318 - Vulnerabilities in Internet Authentication Service Could Allow Remote Code Execution
  • KB 976325 - Cumulative Security Update for Internet Explorer
  • KB 973904 - Vulnerability in WordPad and Office Text Converters Could Allow Remote Code Execution (Released under Master KB 975539).
  • KB 955759 - Microsoft Security Advisory (954157) Security Enhancements for the Indeo Codec
  • KB 970430 - Microsoft Security Advisory (973811) Extended Protection for Authentication
  • KB 971737 - Microsoft Security Advisory (973811) Extended Protection for Authentication

Note: KB 968389 is also included and can be applied directly to a runtime image (see Microsoft Security Advisory (973811)). This will be componentized in the February 2010 security update package.

For full details on the December 2009 Embedded Windows Security Updates see the ECE site:

https://ece.partners.extranet.microsoft.com/ece/Embedded/Products/ProductSupplements/Embedded/XPE/XPEMonthlyUpdates/DisOEM-Dec09WinXPeandWES09SecUpd.htm

Additional Details:

In Odd numbered months, the Security Supplement Update CD contains the Security DQI updates for just that current month, and cumulative Component Database updates in the \Windows folder for each supported Embedded version (SP2, Feature Pack 2007 or Update Rollup 1.0) through the previous even numbered month. In Even numbered months, the Security Supplement Update CD contains the Security DQI updates for just that current month, and the cumulative Component Database updates for each supported Embedded version, which are updated to include the previous odd numbered month, and the current even numbered month updates.

If you are servicing your existing development environment:

On the Embedded Security Supplement Update CD in the \Windows folder, there is a Component Database Update available for each supported Embedded product version (SP2, FP2007, UPR1). If you install the Component Database update applicable to the product version you are using, your database will be current with security updates up to and including the most current even month’s security updates.

If you are servicing deployed images:

Assuming you had the cumulative Component Database updates applied to your development environment  on your image creation date, you need only deliver the DQI updates for each month following your release date and have them applied directly to the image ­or you can update your development environment as described above, and deliver a new image for re-deployment. There may be other methods you employ for servicing your images, these are the two most basic approaches you can take with the updates we provide.

If you are a new developer installing XP Embedded for the first time:

Install XP Embedded up to the product version you wish to use (SP2, Feature Pack 2007 or Update Rollup 1.0). Then install the cumulative Database Component updates provided for that version from the latest Security Supplement Update CD to bring your database up to date with all security updates up to the most recent even numbered month.

Miscellaneous Optional updates:

You will also see other updates available on the ECE which are Optional Updates. These may or may not be applicable to your image and you can review the release notes for applicability to determine if you wish to implement them. These may be provided in DQI format, Component Database update format, or both.

Note:

The Security Supplement Updates were called just Supplement Updates through October 2007, when the name changed to Security Supplement Updates.

If you have questions on accessing the ECE, please email MS Mobile & Embedded Communications Feedback & Support, ECE@microsoft.com.

Thanks,

- Patrick

Technorati Tags: XPe,Embedded Standard