Select the product you need help with

MS11-056: Vulnerabilities in Windows CSRSS could allow elevation of privilege: July 12, 2011

Article ID: 2507938 - View products that this article applies to.

Introduction

Microsoft has released security bulletin MS11-056. To view the complete security bulletin, visit one of the following Microsoft websites:

Home users:
http://www.microsoft.com/security/pc-security/bulletins/201107.aspx
(http://www.microsoft.com/security/pc-security/bulletins/201107.aspx)
Skip the details: Download the updates for your home computer or laptop from the Microsoft Update website now:
http://update.microsoft.com/microsoftupdate/
(http://update.microsoft.com/microsoftupdate/)
IT professionals:
http://www.microsoft.com/technet/security/bulletin/MS11-056.mspx
(http://www.microsoft.com/technet/security/bulletin/MS11-056.mspx)

How to obtain help and support for this security update

Help installing updates: Support for Microsoft Update

(http://support.microsoft.com/ph/6527)

Security solutions for IT professionals: TechNet Security Troubleshooting and Support

(http://technet.microsoft.com/security/bb980617.aspx)

Help protect your computer that is running Windows from viruses and malware: Virus Solution and Security Center

(http://support.microsoft.com/contactus/cu_sc_virsec_master)

Local support according to your country: International Support

(http://support.microsoft.com/common/international.aspx)

Back to the top | Give Feedback

Known issue with this security update

After you install this security update on a computer that is running the release version of Windows 7 or the release version of Windows Server 2008 R2, you may notice that Event ID 33 is logged in the event log every time that the CMD window is opened. The log information shows that a SideBySide error has occurred for Conhost.exe. The event that is logged resembles the following:

Log Name: Application
Source: SideBySide
Event ID: 33
Task Category: None
Level: Error
Keywords: Classic
Description:
Activation context generation failed for conhost.exe. Dependent Assembly Microsoft.Windows.SystemCompatible,processorArchitecture=architecture,publicKeyToken=token,type=win32,version=version_number could not be found. Please use sxstrace.exe for detailed diagnosis.

This error does not affect the CMD window functionality and can be safely ignored. This update has installed successfully, and the system is secured against the attacks that are described in security bulletin MS11-056.

Note This issue only affects the release versions of Windows 7 (RTM) and Windows Server 2008 R2 (RTM) GDR service branch. The Windows 7 and Windows Server 2008 R2 LDR service branches are not affected. This issue does not occur on Windows 7-based and Windows Server 2008 R2-based systems on which Service Pack 1 is installed.

For more information about Service Pack 1 for Windows 7 and for Windows Server 2008 R2, click the following article number to view the article in the Microsoft Knowledge Base:

976932

(http://support.microsoft.com/kb/976932/ )

Information about Service Pack 1 for Windows 7 and for Windows Server 2008 R2

Resolution
To resolve this issue, install security update 2567680. For more information about security update 2567680, click the following article number to view the article in the Microsoft Knowledge Base:

2567680

(http://support.microsoft.com/kb/2567680/ )

MS11-063: Vulnerability in Windows Client/Server Run-time subsystem could allow elevation of privilege: August 9, 2011

Back to the top | Give Feedback

File information

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.