Select the product you need help with
MS09-044: Description of the security update for Remote Desktop Client Version 5.1: August 11, 2009Article ID: 958470 - View products that this article applies to. On This PageINTRODUCTION
Microsoft has released security bulletin MS09-044. To view the complete security bulletin, visit one of the following Microsoft Web sites:
How to obtain help and support for this security updateHelp installing updates: Support for Microsoft Update
(http://support.microsoft.com/ph/6527)
Security solutions for IT professionals: TechNet Security Troubleshooting and Support
(http://technet.microsoft.com/security/bb980617.aspx)
Help protect your computer that is running Windows from viruses and malware: Virus Solution and Security Center
(http://support.microsoft.com/contactus/cu_sc_virsec_master)
Local support according to your country: International Support
(http://support.microsoft.com/common/international.aspx)
MORE INFORMATION
Security update 958470 updates the following binaries:
Collapse this table
Security update 958470 updates the following binaries on the following operating systems: Collapse this table
Collapse this table
Frequently asked questionsQuestion Is RDC 5.0 fixed in on Windows 2000?Answer Yes, the Windows 2000 RDC is fixed by upgrading the RDC version from 5.0 to 5.1. Therefore, there are user interface changes in the RDC client. Also, RDC 5.1 contains some additional functionality, including "redirection." Question My RDC client is in a custom location. Will it be updated? Answer Because of the properties of the older RDC installer, RDC clients that are located in nonstandard locations may not be updated correctly. To address this issue, we recommend that you uninstall the client, reinstall the client by using the default installation properties, and then install the security update. Question Why do I have to install both security update 958471 and security update 958470 when I use Windows 2000 with the in-box RDC 5.0 client? Answer Installing security update 958471 upgrades the in-box RDC 5.0 component to a version of RDC 5.1 that includes this security update. Installing security update 958470 makes no further changes to any binaries, but it still deploys a killbit that prevents the old ActiveX control from being instantiated from Internet Explorer. Therefore, we recommend that you install of both security updates on affected Windows 2000 systems. Note Remote Desktop Connection 5.0 is also known as Terminal Services Client and is sometimes described as RDP because it is the implementation of Remote Desktop Protocol on that system. Question After I install security updates 958470 and 958471 on a Windows 2000-based computer, my RDC user interface changes significantly. Why? Answer By default, Windows 2000-based computers use RDC 5.0. After you install security update 958471, the RDC client is upgraded to RDC 5.1. The newer version of RDC has following changes, compared to RDC 5.0:
Question After I install security update 958471 or security update 958470 in Windows 2000, I experience issues with older applications. Answer You may experience limited application-specific compatibility issues because of user interface changes that are caused by the upgrade from RDC 5.0 to RDC 5.1. Question After I installed security update 958470 or 958471, which upgraded my system from RDC 5.0 to RDC 5.1, I manually reinstalled RDC 5.0. Will I be re-offered the update? Answer Security updates 958470 and 958471 upgrade the computer to RDC 5.1 from RDC 5.0. If you explicitly reinstall RDC 5.0 after deployment, this update will not be re-offered. However, we recommend that you manually download the security update and reinstall it. Note that Microsoft no longer makes RDC 5.0 available for download. Question I have RDC 5.0 through Terminal Services Advanced Client (TSAC). However, security update 958471 is not offered to me. Why? Answer The RDC 5.0 version that is installed through TSAC is updated by security update 958470. Therefore, security update 958470 is offered to you. Question Before I installed the security update, I had the RDC 5.1 version of Msrdp.ocx. After I installed the security update, I do not see the RDC 5.1 version of Msrdp.ocx. Why? Answer After you install this security update, the RDC 5.1 version of Msrdp.ocx is upgraded to the RDC 5.2 version of Msrdp.ocx. Question If I have an application that deploys the Remote Desktop Web Connection binaries in non-default locations, will this security update patch my installation? Answer This update updates the Microsoft Remote Desktop Web Connection binaries in standard locations. If your redistributed Microsoft Remote Desktop Web Connection binaries are in a custom location, you will have to update custom location with the updated Microsoft Remote Desktop Web Connection binaries. Question I installed the security update, and now if I try to use ActiveX component of MSTSC (Msrdp.ocx), I cannot connect. Why? Answer The scenario is broken (see Figure 1) because server is not updated. Therefore, the server is still pushing the vulnerable Msrdp.ocx file to the clients. Before you install the security update, the client computer does not have the ActiveX control (Msrdp.ocx). After you install the security update, the vulnerable ActiveX ClassIds were blocked. Therefore, if you try to use the vulnerable ActiveX Msrdp.ocx by using Internet Explorer, you cannot connect until the client computer receives the new Msrdp.ocx file. To resolve the problem, follow these steps:
Collapse this image  Figure 1: The Remote Desktop Web connection will not work until the client receives an updated Msrdp.ocx file. Note that Windows Update will offer the update automatically if the vulnerable Msrdp.ocx file is available in the standard location on the computer. For more information, visit the following Microsoft Web site: http://technet.microsoft.com/en-us/library/cc775764(WS.10).aspx
* This scenario works if you have RDC 6.0 or a later version installed on the client (workstation) computer.
(http://technet.microsoft.com/en-us/library/cc775764(WS.10).aspx)
Question After I install the security update, Internet Explorer 6 and Internet Explorer 7 do not install the ActiveX component on my computer. Why? Answer Before you install the security update, the computer does not have the ActiveX control (Msrdp.ocx). After the security update is installed, the vulnerable ActiveX ClassIds are killbitted. Therefore, after you install the update, when you try to use the vulnerable ActiveX control (Msrdp.ocx) by using Internet Explorer, you cannot connect until the client computer receives the new Msrdp.ocx file from Windows Update. There are two ways to obtain the latest Msrdp.ocx file:
Question After I install the update, I do not have the Msrdp.ocx file. Why? Answer This update updates only the files that were present on the computer before you installed the update. Therefore, if the Msrdp.ocx file was not on the Windows XP SP2-based computer before you installed the update, the Msrdp.ocx file is not downloaded to or installed on the computer. When the client obtains the Msrdp.ocx file, Windows Update reoffers the update to the client computer. Question How to I determine I have the Msrdp.ocx file on my system? Answer To determine whether the Msrdp.ocx file exists in the default location, run the following command at a command prompt: dir "%windir%\downloaded program files" Question After I install the update, I do not have the Msrdp.cab. Why? Answer This update updates only the files that were present on the computer before you installed the update. For example, if you did not have the Msrdp.cab file on the XP SP2-based computer before you installed the update, the Msrdp.cab file is not installed on the client computer. Question I have an old Msrdp.cab file that is being redistributed from my Terminal Server Web Server computer. Are my clients vulnerable? Answer Your updated client computers will not be vulnerable even if the server is not updated. We strongly recommend that you apply the update on the Terminal Services Web Server so that the redistribution of vulnerable Msrdp.ocx files can be prevented to any clients that are not updated. Question Why is security update 958470 offered to my Windows 2000-based computer even when RDP is not installed? Answer Security update 958470 is offered to Windows 2000-based computers regardless of whether RDP is installed or not. If RDP is not installed, security update 958470 will still deploy killbits to prevent invocation of the affected RDP ActiveX control, but it will not replace any binary. KB offer matrix based on the RDC version and platformsRDC versions (in-band and Microsoft-supported out-of-band releases) Collapse this table
Note In this table, almost all users are represented by the scenarios in the table that contain asterisks (*). FILE INFORMATION
The English (United States) version of this security update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel. Windows 2000 file informationFor all supported editions of Microsoft Windows 2000 Service Pack 4Collapse this table
Windows XP file information
For all supported x86-based versions of Windows XPCollapse this table
For all supported x64-based versions of Windows XPCollapse this table
PropertiesArticle ID: 958470 - Last Review: May 9, 2012 - Revision: 8.0 APPLIES TO
| Article Translations
 |
Back to the top
