Overview of the Office XP Web Services Security Patch: November 11, 2003

Microsoft has released a security patch for Microsoft Office XP and for Microsoft SharePoint Team Services from Microsoft. This security patch offers the highest level of stability and the highest level of enhanced security that is available for Office XP and for SharePoint Team Services. This security patch helps to protect against a security vulnerability that could permit an attacker to send a specially-formed request to a server by using SharePoint Team Services. This could cause a temporary denial of service. The Office XP Web Services Security Patch: KB812708 is part of continued efforts by Microsoft to provide the latest product updates to customers.

This article describes how to download and how to install the Office XP Web Services Security Patch: KB812708.

This security patch was first included in Office XP Service Pack 3 (SP3) for SharePoint Team Services.

For more information about the latest service pack for Office XP Service Pack 3 for SharePoint Team Services, click the following article number to view the article in the Microsoft Knowledge Base:

How to download and how to install the security patch

Important Before you install the security patch, make sure that you meet both of the following conditions:

• Microsoft Windows Installer 2.0
  
  Before you install this patch, you must install Microsoft Windows Installer 2.0 or later. For additional information about this requirement, see the "Windows Installer Patch Requirements" section of this article.
• Microsoft Office XP Service Pack 2 (SP-2)
  
  Before you install this patch, you must install Office XP SP-2. For more information about how to install Office XP Service Pack 2, click the following article number to view the article in the Microsoft Knowledge Base:
  325671  (http://support.microsoft.com/kb/325671/ ) Description of the Office XP Service Pack 2

Client security patch

If you installed Office from a CD, you have two options:

• Use the Office Product Updates Web site to automatically install all the latest updates that include all available service packs and all public updates.
• Install only the Office XP Web Services Patch: KB812708 by following the steps that are described in this article.

Note Microsoft recommends that you install the client security patch by using the Office Product Updates Web site. The Office Product Updates Web site detects your particular installation of Office and then prompts you to install exactly what you must have to make sure that your Office installation is completely up-to-date.

Use the Office Product Updates Web site

For additional information about how you can have the Office Product Updates Web site detect the required updates that you must install on your computer, visit the following Microsoft Web site: After the required updates are detected, you receive a list of recommended updates for your approval. Click Start Installation to complete the process.

Install only the Office XP Web Services Security Patch: KB812708

The following file is available for download from the Microsoft Download Center:

Download the client version of the Office XP Web Services Security Patch: KB812708 package now. (http://download.microsoft.com/download/d/1/3/d1335281-d1d8-4f58-afc2-c6871e6d694f/officexp-kb812708-client-eng.exe)

Release Date: November 11, 2003

For more information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

After you click the link to download the security patch, follow these steps:

1. Click Save to save the Officexp-kb812708-client-Eng.exe file to the selected folder.
2. In Microsoft Windows Explorer, double-click Officexp-kb812708-client-Eng.exe.
3. If you are prompted to install the patch, click Yes.
4. Click Yes to accept the License Agreement.
5. Insert your Office XP CD when you are prompted, and then click OK.
6. When you receive a message that indicates that the installation is successful, click OK.

Note After you install the patch, you cannot remove it.

Administrative security patch

If you installed Office XP from a server location, the server administrator must update the server location with the administrative patch and then deploy that update to your computer.

The following file is available for download from the Microsoft Download Center:
Download the administrative version of the Office XP Web Services Security Patch: KB812708 package now. (http://download.microsoft.com/download/d/1/3/d1335281-d1d8-4f58-afc2-c6871e6d694f/officexp-kb812708-fullfile-eng.exe)

Release Date: November 11, 2003

For more information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.
After you click the link to download the administrative patch, follow these steps if you are the server administrator:

1. Click Save to save the Officexp-kb812708-fullfile-Eng.exe file to the selected folder.
2. In Windows Explorer, double-click Officexp-kb812708-fullfile-Eng.exe.
3. If you are prompted to install the patch, click Yes.
4. Click Yes to accept the License Agreement.
5. In the Type the location where you want to place the extracted files box, type C:\kb812708, and then click OK.
6. Click Yes when you are prompted to create the folder.
7. If you are familiar with the procedure to update your administrative installation, follow these steps:
   1. Click Start, and then click Run.
   2. In the Open box, type the following command:
      msiexec /a Admin Path\MSI File /p C:\kb812708\MSP File SHORTFILENAMES=TRUE
      where Admin Path is the path of your administrative installation point for Office XP (for example, C:\OfficeXP), where MSI File is the .msi database package for Office XP (for example, Proplus.msi), and where MSP File is the name of the administrative patch (for example, Fp5autlff.msp).
      
      Note You can append /qb+ to the command line so that the Office XP Administrative Installation dialog box and the End User License Agreement dialog box do not appear.
8. To deploy the patch to the client workstations, follow these steps:
   1. Click Start, and then click Run.
   2. In the Open box, type the following command:
      msiexec /i Admin Path\MSI File REINSTALL=Feature List REINSTALLMODE=vomu
      where Admin Path is the path of your administrative installation point for Office XP (for example, C:\OfficeXP), where MSI File is the MSI database package for Office XP (for example, Proplus.msi), and where Feature List is the list of feature names (case sensitive) that have to be reinstalled for the patch.
      
      To install all features, you can use REINSTALL=ALL, or you can install the features that are listed in the following table:

For more information about how to update your administrative installation and how to deploy to client workstations, click the following article number to view the article in the Microsoft Knowledge Base: This article contains standard instructions for installing an administrative public update.

For additional information from the Microsoft Office Resource Kit about how to install an administrative public patch, visit the following Microsoft Web site:

How to determine whether the security patch is installed

The client version of the security patch contains updated versions of the following files:The administrative version of the security patch contains updated versions of the following files:

To determine whether the Office XP Web Services Security Patch: KB812708 is installed, follow these steps.

Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

1. Click Start, and then click Search.
2. In the Search Companion pane, click All files and folders.
3. In the All or part of the file name box, type the file name of one of the files that was updated by the Office XP Web Services Security Patch: KB812708, and then click Search.
4. In the list of files, right-click one of the files, and then click Properties.
5. On the Version tab, determine the version of the file to confirm that the Office XP Web Services Security Patch: KB812708 is installed.

For more information about how to determine the version of Word 2002 on your computer, click the following article number to view the article in the Microsoft Knowledge Base: Note If Office XP Web Services Security Patch: KB812708 is already installed on your computer, you receive the following message when you try to install the patch:

List of issues that are fixed by the security patch

The Office XP Web Services Security Patch: KB812708 fixes the issues that are described in the following Microsoft Knowledge Base articles. The Office XP Web Services Security Patch: KB812708 fixes the following issues that were previously not documented in the Microsoft Knowledge Base.

Security: Anonymous denial of service attack vulnerability

A form results but may be vulnerable to anonymous denial of service attacks.

Specially-formed request that is sent to a SharePoint Team Services-based server could cause a temporary denial of service

An attacker could send a specially-formed request to a server that is using SharePoint Team Services. This could cause a temporary denial of service.

Application error when you upgrade to Windows Server 2003 if SharePoint Team Services installed

When you install SharePoint Team Services on Microsoft Windows Server 2003, or when you upgrade from Microsoft Windows 2000 with SharePoint Team Server installed to FrontPage Server Extensions 2002 from Windows Server 2003, an error may occur.

Closing TABLE tag is added when HTML comment is present or when the file is saved as a template

When you add an opening <TABLE> tag that is followed by an HTML comment <!-- --> tag, FrontPage automatically adds the closing </TABLE> tag before the comment. This behavior occurs even if you click Preserve existing HTML in FrontPage. This behavior also occurs if an opening <TABLE> tag without a closing </TABLE> tag is saved as a FrontPage template.

Cannot change NTFS file system permissions through the FrontPage Permissions dialog box

When SharePoint Team Services is started in Internet Service Provider (ISP) mode, you cannot use the FrontPage 2000 permissions dialog box or the FrontPage 98 permissions dialog box to directly apply NTFS permissions. You can do this by using SharePoint Administrator.