MS08-061: Vulnerabilities in Windows kernel could allow elevation of privilege

Known issues with this security update

Dual monitor issue

After you install this update on a computer that is running Windows XP or Windows Server 2003, you may receive a "Stop 0x0000008E" error message when you switch the operating system from a dual monitor setting to a single monitor setting.
For more information about this issue, click the following article number to view the article in the Microsoft Knowledge Base:

959252 Error message when you switch the operating system from a dual monitor setting to a single monitor setting on a Windows XP-based computer or on a Windows Server 2003-based computer that has the security update 954211 installed: "Stop 0x0000008E"

Windows XP Service Pack 3 unsigned Win32k.sys issue

Summary

If the installation of Windows XP Service Pack 3 fails for any reason, the win32k.sys binary file becomes unsigned. This issue can also occur if you uninstall Service Pack 3 after a successful installation. If you encounter this issue, and then you successfully install Service Pack 3, the win32k.sys binary file is signed correctly, and this issue is no longer observed.

How does this update correct this issue?

If an unsigned version of the win32k.sys binary file exists on a system, this update detects the file. Then, it resolves the problem by putting the correct hash of the binary file in the master catalog. Therefore, the binary file becomes signed, and then the installer exits, causing an installation failure. After this occurs, the package is re-offered to the system. To make sure that the vulnerability that is described in this bulletin is resolved, the update must be applied again. After the second installation of the package, the update works correctly by updating the win32k.sys binary file with the new version that carries the fixes that are described in this article.

Installation experience with this update for customers who have Windows XP Service Pack 2 installed

On certain Windows XP Service Pack 2-based systems, this update may be offered a second time. This is expected behavior. You may have to install this package two times to correctly complete the installation.

File information

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

For all supported editions of Microsoft Windows 2000 Service Pack 4

Windows XP and Windows Server 2003 file information notes

• The files that apply to a specific milestone (RTM, SPn) and service branch (QFE, GDR) are noted in the "SP requirement" column and in the "Service branch" column.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. QFE service branches contain hotfixes in addition to widely released fixes.
• In addition to the files that are listed in these tables, this software update also installs an associated security catalog file (KBnumber.cat) that has a Microsoft digital signature.

For all supported 32-bit editions of Windows XP

For all supported 32-bit editions of Windows Server 2003

For all supported x64-based editions of Windows Server 2003 or Windows XP Professional

For all supported Itanium-based editions of Windows Server 2003

Windows Vista and Windows Server 2008 file information notes

• You can identify the files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) by examining the file version numbers as shown in the following table:
  
  
  
  

  Version	Product	Milestone	Service branch
  6.0.600 0. 16xxx	Windows Vista	RTM	GDR
  6.0.600 0. 20xxx	Windows Vista	RTM	LDR
  6.0.600 1. 18xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	GDR
  6.0.600 1. 22xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR

• Service Pack 1 is integrated into the original release version of Windows Server 2008. Therefore, RTM milestone files apply only to Windows Vista. RTM milestone files have a 6.0.0000. xxxxxx version number.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST (.manifest) files and the MUM (.mum) files that are installed for each environment are listed separately in the "Additional files for all supported x86-based versions of Windows Server 2008 and of Windows Vista" section. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files, for which the attributes are not listed, have a Microsoft digital signature.

For all supported x86-based versions of Windows Server 2008 and of Windows Vista

For all supported x64-based versions of Windows Server 2008 and of Windows Vista

For all supported IA-64-based versions of Windows Server 2008

Additional file information for Windows Server 2008 and for Windows Vista

Additional files for all supported x86-based versions of Windows Server 2008 and of Windows Vista

Additional files for all supported x64-based versions of Windows Server 2008 and of Windows Vista

Additional files for all supported IA-64-based versions of Windows Server 2008