MS02-018: April 2002 Cumulative Patch for Internet Information Services

Microsoft has released a cumulative patch for Internet Information Server (IIS) 4.0, Internet Information Services (IIS) 5.0, and IIS 5.1 that includes updates for the issues that are described in the following Microsoft Knowledge Base articles: NOTE: These patches do not include fixes for vulnerabilities involving non-IIS products, such as the Front Page Server Extensions and Index Server, even though these products are closely associated with IIS and are typically installed on IIS servers. There is, however, one exception. The fix for the vulnerability that affects Index Server, which is discussed in Microsoft Security Bulletin MS01-033, is included in this patch because of the seriousness of the issue for IIS servers. At the time that this article was written, the Microsoft Security Bulletins that discuss these vulnerabilities are as follows: All of the previously listed fixes and cumulative patches are included in Windows 2000 Service Pack 3. For more information about the latest service pack for Windows 2000, click the following article number to view the article in the Microsoft Knowledge Base: NOTE: The fixes for the following vulnerabilities that affect IIS 4.0 are not included in the patch because they require administrative action instead of a software change. Administrators should make sure that in addition to applying this patch, they also take the administrative action that is described in the following bulletins: For more information about the latest service pack for Windows XP, click the following article number to view the article in the Microsoft Knowledge Base: For more information about the latest service pack for Windows 2000, click the following article number to view the article in the Microsoft Knowledge Base:

For more information about this patch, visit the following Microsoft Web site:

• Internet Information Services 5.1
• Internet Information Services 5.0
• Internet Information Server 4.0
• Windows NT Server 4.0, Terminal Edition

Internet Information Services 5.1

To resolve these problems, obtain the latest service pack for Windows XP. For more information, click the following article number to view the article in the Microsoft Knowledge Base: Before you apply the update that is described in the following section, back-up your metabase.

The following file is available for download from the Microsoft Download Center:
Download the Q319733 package now.

You do not have to restart your computer after you apply this update. The installer stops and restarts the IIS service automatically. If you are prompted to restart your computer, ignore the prompt.

The Q319733 package supports the following switches: The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. NOTE: Due to file dependencies, this update may contain additional files.

Internet Information Services 5.0

To resolve these problems, obtain the latest service pack for Windows 2000. For more information, click the following article number to view the article in the Microsoft Knowledge Base: Before you apply the update that is described in the following section, back-up your metabase. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
The following files are available for download from the Microsoft Download Center:
Release Date: April 10, 2002

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

After you apply this update, space characters such as white space, tabs, carriage returns, and line feeds in the IIS log file are replaced with plus signs (+). If you have a log analyzer that parses the IIS log file, you may have to update it to accommodate this change. To work around this problem while you update your log analyzer, extract the patch with the "-x" switch and do not install the Iislog.dll file.

You do not have to restart your computer after you apply this update, because the installer stops and restarts the IIS service automatically.

The Q319733 package supports the following switches: The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. NOTE: Due to file dependencies, this update may contain additional files. This update requires Windows 2000 Service Pack 2 (SP2) or SP1.

Internet Information Server 4.0

Before you apply this update, backup your metabase. For more information, click the following article number to view the article in the Microsoft Knowledge Base: The following file is available for download from the Microsoft Download Center:
Release Date: April 10, 2002

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file. Perform the following steps to avoid the need to restart your computer:

NOTE: Although you can avoid the need to restart your computer after applying this patch, the computer will NOT be considered patched and protected until after a restart. Unlike in Windows 2000 (IIS 5), in Windows NT 4.0 (IIS 4) the older .dll files are not automatically updated. The steps to avoid a restart should only be taken if you want to apply more than one patch before you restart the computer, and should always be followed by a restart.

1. Stop all IIS services.
2. Install the patch with the hotfix with "/z" switch.
3. Restart the IIS services.

The Q319733 package supports the following switches: The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. NOTE: Due to file dependencies, this update may contain additional files. This update requires Windows NT 4.0 Service Pack 6a (SP6a).

Windows NT Server 4.0, Terminal Edition

Internet Information Server 4.0 is part of the Windows NT 4.0 Option Pack which is not supported on Windows NT Server 4.0, Terminal Server Edition. Patches for IIS 4.0 have been provided as part of the Windows NT Server 4.0, Terminal Server Edition, Security Rollup Package (SRP) only for customers who have installed the Option Pack to protect their computers during the migration to a supported operating system. For more information about the SRP, click the following article number to view the article in the Microsoft Knowledge Base: