MS08-061: Vulnerabilities in Windows kernel could allow elevation of privilege

View products that this article applies to.

INTRODUCTION

Microsoft has released security bulletin MS08-061. To view the complete security bulletin, visit one of the following Microsoft Web sites:

Home users:
http://www.microsoft.com/protect/computer/updates/bulletins/200810.mspx (http://www.microsoft.com/protect/computer/updates/bulletins/200810.mspx)
Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:
http://update.microsoft.com/microsoftupdate/ (http://update.microsoft.com/microsoftupdate/)
IT professionals:
http://www.microsoft.com/technet/security/bulletin/MS08-061.mspx (http://www.microsoft.com/technet/security/bulletin/MS08-061.mspx)

Back to the top

How to obtain help and support for this security update

For home users, no-charge support is available by calling 1-866-PCSAFETY in the United States and Canada or by contacting your local Microsoft subsidiary. For more information about how to contact your local Microsoft subsidiary for support issues with security updates, visit the Microsoft International Support Web site:

http://support.microsoft.com/common/international.aspx?rdpath=4 (http://support.microsoft.com/common/international.aspx?rdpath=4)

North American customers can also obtain instant access to unlimited no-charge e-mail support or to unlimited individual chat support by visiting the following Microsoft Web site:

http://support.microsoft.com/oas/default.aspx?&prid=7552 (http://support.microsoft.com/oas/default.aspx?&prid=7552)

For enterprise customers, support for security updates is available through your usual support contacts.

Back to the top

Known issues with this security update

Dual monitor issue

After you install this update on a computer that is running Windows XP or Windows Server 2003, you may receive a "Stop 0x0000008E" error message when you switch the operating system from a dual monitor setting to a single monitor setting.
For more information about this issue, click the following article number to view the article in the Microsoft Knowledge Base:

959252 (http://support.microsoft.com/kb/959252/ ) Error message when you switch the operating system from a dual monitor setting to a single monitor setting on a Windows XP-based computer or on a Windows Server 2003-based computer that has the security update 954211 installed: "Stop 0x0000008E"

Windows XP Service Pack 3 unsigned Win32k.sys issue

Summary

If the installation of Windows XP Service Pack 3 fails for any reason, the win32k.sys binary file becomes unsigned. This issue can also occur if you uninstall Service Pack 3 after a successful installation. If you encounter this issue, and then you successfully install Service Pack 3, the win32k.sys binary file is signed correctly, and this issue is no longer observed.

How does this update correct this issue?

If an unsigned version of the win32k.sys binary file exists on a system, this update detects the file. Then, it resolves the problem by putting the correct hash of the binary file in the master catalog. Therefore, the binary file becomes signed, and then the installer exits, causing an installation failure. After this occurs, the package is re-offered to the system. To make sure that the vulnerability that is described in this bulletin is resolved, the update must be applied again. After the second installation of the package, the update works correctly by updating the win32k.sys binary file with the new version that carries the fixes that are described in this article.

Installation experience with this update for customers who have Windows XP Service Pack 2 installed

On certain Windows XP Service Pack 2-based systems, this update may be offered a second time. This is expected behavior. You may have to install this package two times to correctly complete the installation.

File information

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.