United States

Change

All Microsoft Sites

Microsoft Support

Article ID: 831931 - Last Review: January 9, 2007 - Revision: 6.4

Description of the Microsoft Project 2002 security update: October 12, 2004

View products that this article applies to.

SUMMARY

Microsoft has released an update to Microsoft Project 2002. This article describes how to download and install the Project 2002 security update: KB831931.

Back to the top

This update fixes a vulnerability where a specially crafted image could allow an attacker’s code to run on a user’s computer because of a security vulnerability in the graphics interpreter code.

Microsoft has released security bulletin MS04-028. The security bulletin contains all the relevant information about the security update, including file manifest information and deployment options. To view the complete security bulletin, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/bulletin/ms04-028.mspx (http://www.microsoft.com/technet/security/bulletin/ms04-028.mspx)

Release history:

Project 2002 Security Update: KB831931 Version 1.0 - Released September 14, 2004
Project 2002 Security Update: KB831931 Version 2.0 - Released October 12, 2004

The Project 2002 Security Update: KB831931 Version 2.0 that was released October 12, 2004 addresses a patching issue that occurs when you apply the update on a computer where MSI 3.0 is installed. We recommend that all users who have Microsoft Windows XP Service Pack 2 (SP2) installed run the current version of the update even if an earlier version is installed.

Back to the top

MORE INFORMATION

Back to the top

How to download and install the update

Important Before you install this update, make sure that the following requirements have been met:

Microsoft Windows Installer version 2.0 or a later version is installed on the computer.

For additional information about this requirement, see the "Windows Installer update requirements" section.
Microsoft Project 2002 Service Pack 1 (SPI).

Before you install this update, you must install Microsoft Project 2002 SP1.

For more information about Microsoft Project 2002 Service Pack 1, click the following article number to view the article in the Microsoft Knowledge Base:
830241 (http://support.microsoft.com/kb/830241/ ) Description of Microsoft Project 2002 Service Pack 1

If you are an administrator, note the following:

Administrators who do not want to install Microsoft Project 2002 SP1, and who want to install this update on a computer that is running the original release version of Microsoft Project 2002 can follow the steps that are listed in the “Methods for installing the update on a computer that is running the original release version of Microsoft Project 2002 (for administrative users only)” section.

We recommend that you install the latest service pack for Microsoft Project 2002 to make sure that you have the latest updates for Microsoft Project 2002.

Client update

If you installed Microsoft Project from a CD-ROM, you have the following two options:

Use the Microsoft Office Update Web site to automatically install all the latest updates that include all available service packs and public updates.
Install only the Project 2002 security update: KB831931 by following the steps that are described later in this article.

Note We recommend that you install the client update by using the Microsoft Office Update Web site. The Microsoft Office Update Web site detects your particular installation of Microsoft Project and prompts you to install exactly what you must have to make sure that your Microsoft Office installation is up-to-date.

Microsoft Office Update Web site

To have the Microsoft Office Update Web site detect the required updates that you must install on your computer, visit the following Microsoft Web site, and then click Check for Updates:

http://office.microsoft.com/en-us/downloads/maincatalog.aspx (http://office.microsoft.com/en-us/downloads/maincatalog.aspx)

After detection is complete, you receive a list of recommended updates for your approval. Click Start Installation to complete the process.

Install only the Project 2002 security update: KB831931

Follow these steps to download and install the update:

To download the update, visit the following Microsoft Web site:
http://www.microsoft.com/downloads/details.aspx?FamilyId=B3EBCCEA-B0E4-41C7-A6F4-413864D2CCF3 (http://www.microsoft.com/downloads/details.aspx?FamilyId=B3EBCCEA-B0E4-41C7-A6F4-413864D2CCF3)
Note A localized version of the update is also available at this Web site.
Click Open to start the download and installation of the Project2002-kb831931-v2-fullfile-enu.exe file.
If you are prompted to install the update, click Yes.
Click Yes to accept the License Agreement.
Insert your Microsoft Project 2002 CD-ROM if you are prompted to do so, and then click OK.
When you receive a message that indicates the installation was successful, click OK.

Note After you install the update, you cannot remove it. To revert to an installation before the update was installed, you must remove Microsoft Project 2002, and then install it again from the original CD-ROM.

Administrative update

If you installed Microsoft Project 2002 from a server location, the server administrator must update the server location with the administrative update and deploy that update to your computer.

If you are the server administrator, follow these steps to download the administrative update:

In Microsoft Windows Explorer, create a new folder on drive C, and then name the folder kb831931.
To download the full-file update, visit the following Microsoft Web site:
http://www.microsoft.com/downloads/details.aspx?FamilyId=B3EBCCEA-B0E4-41C7-A6F4-413864D2CCF3 (http://www.microsoft.com/downloads/details.aspx?FamilyId=B3EBCCEA-B0E4-41C7-A6F4-413864D2CCF3)
Note A localized version of the full-file update is also available at this Web site.
Click Save to save the Project2002-kb831931-v2-fullfile-enu.exe file to the C:\KB831931 folder.
Click Start, click Run, type cmd in the Open box, and then click OK.
At the command prompt, type the following lines, pressing ENTER after each line:
cd\kb831931
Project2002-kb831931-v2-fullfile-enu.exe /c /t:c:\kb831931
Click Yes to accept the License Agreement.
At the command prompt, type exit to quit the command prompt.
If you are familiar with the procedure for updating your administrative installation, click Start, click Run, and then type the following command in the Open box:
msiexec /a Admin Path\MSI File /p C:\kb831931\MSP File SHORTFILENAMES=TRUE
In this example, Admin Path is the path of your administrative installation point for Microsoft Project 2002 (for example, C:\Project2002), MSI File is the .msi database package for the Microsoft Project 2002 product (for example, Prjpro.msi), and MSP File is the name of the administrative update (for example, Project2002-kb831931-fullfile.msp).

Note You can append /qb+ to the command line so that the Project 2002 Administrative Installation dialog box and the End User License Agreement dialog box do not appear.
To deploy the update to the client workstations, click Start, click Run, and then type the following command in the Open box:
msiexec /i Admin Path\MSI File /qb REINSTALL=Feature List REINSTALLMODE=vomu
In this example, Admin Path is the path of your administrative installation point for Project 2002 (for example, C:\Project2002), MSI File is the MSI database package for the Microsoft Project 2002 product (for example, Prjpro.msi), and Feature List is the list of feature names (case sensitive) that have to be reinstalled for the update. To install all features, you can use REINSTALL=ALL, or you can install the following feature:
ProductFiles

For more information about how to update your administrative installation and deploy to client workstations, click the following article number to view the article in the Microsoft Knowledge Base:

301348 (http://support.microsoft.com/kb/301348/ ) How to install a public update to administrative installations of Office XP

Methods for installing the update on a computer that is running the original release version of Microsoft Project 2002 (for administrators only)

If you are an administrator, and you want to install this update on the original release version of Microsoft Project 2002, use one of the following methods, depending on your situation.

Method 1: Modify the OHotfix.ini file

Use this method if you are an administrator, and if you use the Ohotfix.exe program to install updates. Manually modify the OHotfix.ini file to change the RequireAllProductsAtMinVersion=1 setting to RequireAllProductsAtMinVersion=0 and to change the MinProductVersion=10.0.8326.0 setting to MinProductVersion=. To use this method, you have to extract the .msp files from the executable (.exe) file of the update. For more information about how to extract the .msp files from the .exe file, see the "Administrative update" section.

To modify the OHotfix.ini file, follow these steps:

Start Notepad, and then open the OHotfix.ini file.
Locate the following line:
RequireAllProductsAtMinVersion=1
Change the line to the following:
RequireAllProductsAtMinVersion=0
Locate the following line:
MinProductVersion=10.0.8326.0
Change the line to the following:
MinProductVersion=
Save the OHotfix.ini file.

For more information about how to install updates by using OHotfix.exe program, visit the following Microsoft Web site:

http://office.microsoft.com/en-us/ork2003/HA011364081033.aspx (http://office.microsoft.com/en-us/ork2003/HA011364081033.aspx)

Method 2: Use the Msiexec.exe /p command line to install the update

Use this following method if you are an administrator, and you use the Msiexec.exe command to install updates. Do not use this method if you are updating an administrative image or if you are updating an administrative installation point.

Use the Msiexec.exe /p command line to install the .msp files that are required for Microsoft Project 2002. To use this method, you have to extract the .msp files from the executable (.exe) file of the update. For more information about how to extract the .msp files from the .exe file, see the "Administrative update" section.

The following is an example of the command line that you can use to install this update by using the Msiexec.exe /p command:

Msiexec.exe /p Path\Project2002-KB831931-FullFile-ENU.msp /qb- /L*v c:\GDILog.txt

Back to the top

How to determine whether the update is installed

The update contains an updated version of the following file:

   File name  Version
   ----------------------
   Mso.dll    10.0.6714.0

To determine the version of the Mso.dll file that is installed on your computer, follow these steps.

Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

Click Start, and then click Search.
In the Search Results pane, click All files and folders under Search Companion.
In the All or part of the file name box, type Mso.dll, and then click Search.
In the list of files, right-click Mso.dll, and then click Properties.

Note If your search locates multiple Mso.dll files on your computer, locate the Mso.dll file in the following folder:
C:\Program Files\Common Files\Microsoft Shared\Office10
On the Version tab, determine the version of the Mso.dll file that is installed on your computer.

Note If the Project 2002 security update: KB831931 is already installed on your computer, you receive the following error message when you try to install the Project 2002 security update: KB831931:

This update has already been applied or is included in an update that has already been applied.

Back to the top

Windows Installer update requirements

You must have Windows Installer 2.0 or a later version to install the update that is described in this article. Both Microsoft Windows XP and Microsoft Windows 2000 Service Pack 3 (SP3) include Windows Installer 2.0 or a later version.

To install the latest version of the Windows Installer, visit one of the following Microsoft Web sites:

Windows Installer for Microsoft Windows 95, for Microsoft Windows 98, and for Microsoft Windows Millennium Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyID=cebbacd8-c094-4255-b702-de3bb768148f&DisplayLang=en (http://www.microsoft.com/downloads/details.aspx?FamilyID=cebbacd8-c094-4255-b702-de3bb768148f&DisplayLang=en)
Windows Installer for Microsoft Windows NT 4.0 and for Microsoft Windows 2000:
http://www.microsoft.com/downloads/details.aspx?FamilyID=4b6140f9-2d36-4977-8fa1-6f8a0f5dca8f&DisplayLang=en (http://www.microsoft.com/downloads/details.aspx?FamilyID=4b6140f9-2d36-4977-8fa1-6f8a0f5dca8f&DisplayLang=en)

Back to the top

List of issues that are fixed by the update

The Project 2002 security update: KB831931 fixes the following issue that was previously not documented in the Microsoft Knowledge Base.

Microsoft Project 2002 may close unexpectedly when you insert an image

When you try to insert a JPEG image, Microsoft Project 2002 may quit unexpectedly, and arbitrary macro code could run.

Back to the top

REFERENCES

If you are an administrator, you may want to install all required GDI+ security updates in one batch process. For more information about how to create and use a batch file to silently install multiple GDI+ security updates, click the following article number to view the article in the Microsoft Knowledge Base:

885885 (http://support.microsoft.com/kb/885885/ ) How to create and use a batch file to silently install multiple GDI+ security updates

For more information a known issue that may occur when you install the original version of this update, released September 14, on a Windows XP Service Pack 2-based computer, click the following article number to view the article in the Microsoft Knowledge Base:

885876 (http://support.microsoft.com/kb/885876/ ) Important information that you must know about the MS04-028 security updates if you are using Windows XP Service Pack 2

For more information about deployment, click the following article numbers to view the articles in the Microsoft Knowledge Base:

885920 (http://support.microsoft.com/kb/885920/ ) How to detect clients that require Critical Security Update MS04-028 in Systems Management Server 2003

886988 (http://support.microsoft.com/kb/886988/ ) How to obtain and use the MS04-028 Enterprise Update Scanning Toot

Back to the top