MS06-061: Security update for Microsoft XML Core Services 4.0 SP2

2020-04-13T02:02:25
ID KB925672
Type mskb
Reporter Microsoft
Modified 2020-04-16T06:54:41

Description

<html><body><p>Resolves several newly discovered, privately reported vulnerabilities that could allow an attacker to take complete control of an affected system.</p><h2>INTRODUCTION</h2><div class="kb-summary-section section">Microsoft has released security bulletin MS06-061. The security bulletin contains all the relevant information about the security update. This information includes file manifest information and deployment options. To view the complete security bulletin, visit one of the following Microsoft Web sites: <ul class="sbody-free_list"><li>Home users:<div class="indent"><a href="http://www.microsoft.com/athome/security/update/bulletins/200610.mspx" id="kb-link-1" target="_self">http://www.microsoft.com/athome/security/update/bulletins/200610.mspx</a></div></li><li>IT professionals:<div class="indent"><a href="http://www.microsoft.com/technet/security/bulletin/ms06-061.mspx" id="kb-link-2" target="_self">http://www.microsoft.com/technet/security/bulletin/ms06-061.mspx</a></div></li></ul></div><h2>More Information</h2><div class="kb-moreinformation-section section"><h3 class="sbody-h3">Known issues with this security update</h3><ul class="sbody-free_list"><li>When you install security update 925672 for MSXML 4.0, and you use the "quiet" option, a progress window may appear. The command for the "quiet" option is as follows:<div class="indent">/quiet</div></li><li>You may be repeatedly offered this update.<br/><br/>Different versions of MSXML are included with various Microsoft products, such as Windows, Internet Explorer, Microsoft Office, and Microsoft SQL Server, as well as some third-party products. You may be offered this update again if you install a new product or if you update a product that includes a different version of MSXML than you already have. <span>For more information about the different MSXML versions that are available or included with various Microsoft products or software updates, click the following article number to view the article in the Microsoft Knowledge Base:<br/><br/><div class="indent"><a href="https://support.microsoft.com/en-us/help/269238" id="kb-link-3">269238 </a> List of Microsoft XML Parser (MSXML) versions<br/><br/></div></span></li><li>Security update packages 925672 and 925673 for MSXML 4.0 Service Pack 2 (SP2) and MSXML 6.0 are complete installation packages. You can use these packages to install MSXML 4.0 SP2 or MSXML 6.0 on a computer that has no earlier versions of MSXML 4.0 or MSXML 6.0 installed. You can also use these packages to update an existing installation of MSXML 4.0, MSXML 4.0 SP1, or MSXML 6.0.</li><li>Windows Update and Microsoft Update only offer security update packages 925672 and 925673 if an earlier version of MSXML 4.0 SP2 or MSXML 6.0 is already installed on your computer. If you do not have an earlier version of MSXML 4.0 SP2 or MSXML 6.0 installed, download and install these packages from the Microsoft Download Center.</li><li>Windows Update and Microsoft Update do not offer security update 925672 if you have MSXML 4.0 or MSXML 4.0 SP1 installed. To update MSXML 4.0 or MSXML 4.0 SP1, use one of the following methods:<ul class="sbody-free_list"><li><span class="text-base">Method 1</span>: Download and install security update 925672 from the Microsoft Download Center. To do this, visit the following Microsoft Web site:<br/><div class="indent"><a href="http://www.microsoft.com/download/details.aspx?familyid=961f3c95-ec4e-4561-ab27-b3180e9139c5" id="kb-link-4" target="_self">http://www.microsoft.com/download/details.aspx?familyid=961f3c95-ec4e-4561-ab27-b3180e9139c5</a></div></li><li><span class="text-base">Method 2</span>: Download and install MSXML 4.0 SP2, and then install security update 925672 from Windows Update or from Microsoft Update. To download MSXML 4.0 SP2, visit the following Microsoft Web site:<br/><div class="indent"><a href="http://www.microsoft.com/download/details.aspx?familyid=3144b72b-b4f2-46da-b4b6-c5d7485f2b42" id="kb-link-5" target="_self">http://www.microsoft.com/download/details.aspx?familyid=3144b72b-b4f2-46da-b4b6-c5d7485f2b42</a></div></li></ul></li><li>The files that are installed by security updates 925672 and 925673 for MSXML 4.0 SP2 and MSXML 6.0 are listed in the following tables.<br/><br/><span class="text-base">MSXML 6.0 is not installed</span><div class="table-responsive"><table class="sbody-table table"><tr class="sbody-tr"><td class="sbody-td">File Name</td><td class="sbody-td">Version</td><td class="sbody-td">Date</td><td class="sbody-td">Time</td><td class="sbody-td">Size</td></tr><tr class="sbody-tr"><td class="sbody-td">Msxml6.dll</td><td class="sbody-td">6.0.3888.0</td><td class="sbody-td">1-Sep-06</td><td class="sbody-td">12:08</td><td class="sbody-td">1.27 MB</td></tr><tr class="sbody-tr"><td class="sbody-td">Msxml6r.dll</td><td class="sbody-td">6.0.3883.0</td><td class="sbody-td">19-Jul-06</td><td class="sbody-td">10:55</td><td class="sbody-td">84.6 KB</td></tr></table></div><span class="text-base">MSXML 6.0 is installed</span><div class="table-responsive"><table class="sbody-table table"><tr class="sbody-tr"><td class="sbody-td">File Name</td><td class="sbody-td">Version</td><td class="sbody-td">Date</td><td class="sbody-td">Time</td><td class="sbody-td">Size</td></tr><tr class="sbody-tr"><td class="sbody-td">Msxml6.dll</td><td class="sbody-td">6.0.3888.0</td><td class="sbody-td">1-Sep-06</td><td class="sbody-td">12:08</td><td class="sbody-td">1.27 MB</td></tr></table></div><span class="text-base">MSXML 4.0 is not installed</span><div class="table-responsive"><table class="sbody-table table"><tr class="sbody-tr"><td class="sbody-td">File Name</td><td class="sbody-td">Version</td><td class="sbody-td">Date</td><td class="sbody-td">Time</td><td class="sbody-td">Size</td></tr><tr class="sbody-tr"><td class="sbody-td">Msxml4.dll</td><td class="sbody-td">4.20.9839.0</td><td class="sbody-td">12-Sep-06</td><td class="sbody-td">5:51</td><td class="sbody-td">1216 KB</td></tr><tr class="sbody-tr"><td class="sbody-td">Msxml4r.dll</td><td class="sbody-td">4.10.9404.0</td><td class="sbody-td">12-Jul-06</td><td class="sbody-td">5:49</td><td class="sbody-td">80.5 KB</td></tr></table></div><span class="text-base">Note</span> This security update is installed in both the %SystemRoot%\System32 folder and the side-by-side folder.<br/><br/><span class="text-base">MSXML 4.0 is installed</span><div class="table-responsive"><table class="sbody-table table"><tr class="sbody-tr"><td class="sbody-td">File Name</td><td class="sbody-td">Version</td><td class="sbody-td">Date</td><td class="sbody-td">Time</td><td class="sbody-td">Size</td></tr><tr class="sbody-tr"><td class="sbody-td">Msxml4.dll</td><td class="sbody-td">4.20.9839.0</td><td class="sbody-td">12-Sep-06</td><td class="sbody-td">5:531</td><td class="sbody-td">1.18 MB</td></tr></table></div><span class="text-base">Note</span> This security update is installed both in side-by-side mode and in %SystemRoot%\SYSTEM32.</li><li>When you remove security update 925673 for MSXML 6.0, MSXML 6.0 is completely removed from the computer.</li><li>Security update 925672 for MSXML 4.0 SP2 does not support the complete removal of MSXML 4.0 because this version of MSXML is installed in side-by-side mode. To work around this issue, follow these steps:<ol class="sbody-num_list"><li>Remove security update 925672 by using the Add or Remove Programs item in Control Panel.</li><li>Delete the MSXML4.dll file from the %SystemRoot%\System32 folder.</li><li>Repair MSXML 4.0 by using the Add or Remove Programs item in Control Panel.</li></ol> The earlier versions of the Msxml4.dll and Msxml4r.dll files are restored to both the %SystemRoot%\System32 folder and the side-by-side folder.</li><li>The security update packages for MSXML 3.0 only update the MSXML3.dll file. The resource files are not updated for this version.</li><li>If the Msxml4.dll file is locked, the file may not be updated when you apply security update MS06-071 for MSXML 4.0, for MSXML 4.0 SP1, and for MSXML 4.0 SP2. To work around this issue, use the following commands to uninstall Msxml4.dll:<ul class="sbody-free_list"><li><span class="sbody-userinput">MsiExec.exe /uninstall {A9CF9052-F4A0-475D-A00F-A8388C62DD63} /passive</span></li><li><span class="sbody-userinput">Del %windir%\system32\msxml4.dll</span></li></ul></li></ul></div></body></html>