MS09-044: Description of the security update for Remote Desktop Client Version 5.2: August 11, 2009

Microsoft has released security bulletin MS09-044. To view the complete security bulletin, visit one of the following Microsoft Web sites:

• Home users:
  http://www.microsoft.com/security/updates/bulletins/200908.aspx
  Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:
  http://update.microsoft.com/microsoftupdate
• IT professionals:
  http://www.microsoft.com/technet/security/bulletin/ms09-044.mspx

How to obtain help and support for this security update

Help installing updates: Support for Microsoft Update

Security solutions for IT professionals: TechNet Security Troubleshooting and Support

Help protect your computer that is running Windows from viruses and malware: Virus Solution and Security Center

Local support according to your country: International Support

Security update 958469 updates the following binaries: Note The files are updated only if the files were already present on the client computer.

Security update 958469 updates the following binaries on the following operating systems: Note that in specific deployments on out-of-box versions of the RDP client, files may be renamed during installation. The file names listed in the "File information" in this article are the original names prior to installation.

Known issues with this security update

After you install this update, gridlines may be visible in a terminal session window when you use Remote Desktop Client (RDC) to connect to a terminal server and then scroll up and down in a Web page in the terminal session. For more information about how to resolve this issue, click the following article numbers to view the articles in the Microsoft Knowledge Base:

Frequently asked questions

Question If I have an application that deploys the Remote Desktop Web Connection binaries in non-default locations, will this security update patch my installation?
Answer This update updates the Microsoft Remote Desktop Web Connection binaries in standard locations. If your redistributed Microsoft Remote Desktop Web Connection binaries are in a custom location, you will have to update the custom location with the updated Microsoft Remote Desktop Web Connection binaries.

Question Before I installed the security update, I had the RDC 5.1 version of Msrdp.ocx. After I installed the security update, I do not see the RDC 5.1 version of Msrdp.ocx. Why?
Answer After you install this security update, the RDC 5.1 version of Msrdp.ocx is upgraded to the RDC 5.2 version of Msrdp.ocx.

Question I installed the security update, and now if I try to use ActiveX component of MSTSC (Msrdp.ocx), I cannot connect. Why?
Answer The scenario is broken (see Figure 1) because server is not updated. Therefore, the server is still pushing the vulnerable Msrdp.ocx file to the clients. Before you install the security update, the client computer does not have the ActiveX control (Msrdp.ocx). After you install the security update, the vulnerable ActiveX ClassIds were blocked. Therefore, if you try to use the vulnerable ActiveX Msrdp.ocx by using Internet Explorer, you cannot connect until the client computer receives the new Msrdp.ocx file. To resolve the problem, follow these steps:

• Reinstall the security update on the client workstation to update the older version of the Msrdp.ocx file that was downloaded from the server.
  
  Note The Msrdp.ocx file is updated only in the standard locations.
• Ask your Web server administrators to update the server-side Msrdp.cab file by using the security update. Administrators should be aware that the update updates only Msrdp.cab files that are found in the standard locations. To update Msrdp.cab files that are in custom locations, follow these steps:
  1. Extract the update (KB) by using the KB /x:<path> command.
  2. Copy the Msrdp.cab from <location> to the custom path.

Figure 1: The Remote Desktop Web connection will not work until the client receives an updated Msrdp.ocx file. Note that Windows Update will offer the update automatically if the vulnerable Msrdp.ocx file is available in the standard location on the computer. For more information, visit the following Microsoft Web site: * This scenario works if you have RDC 6.0 or a later version installed on the client (workstation) computer.

Question After I install the update, I do not have the Msrdp.ocx file. Why?
Answer This update updates only the files that were present on the computer before you installed the update. Therefore, if the Msrdp.ocx file was not on the Windows XP SP2-based computer before you installed the update, the Msrdp.ocx file is not downloaded to or installed on the computer. When the client obtains the Msrdp.ocx file, Windows Update reoffers the update to the client computer.

Question How can I determine whether I have the Msrdp.ocx file on my computer?
Answer To determine whether the Msrdp.ocx file exists in the default location, run the following command at a command prompt:

Question After I installed the update, I do not have the Msrdp.cab file. Why?
Answer This update updates only the files that were present on the computer before you installed the update. Therefore, if the Msrdp.cab file was not on the Windows XP SP2-based computer before you installed the update, the Msrdp.cab file is not downloaded to or installed on the computer.

Question I have an old Msrdp.cab file that is being redistributed from my Terminal Server Web Server computer. Are my clients vulnerable?
Answer Your updated client computers will not be vulnerable even if the server is not updated. We strongly recommend that you install the update on the Terminal Server Web Server computer so that redistributing of vulnerable Msrdp.ocx files can be prevented to any clients that are not updated.

KB offer matrix based on the RDC version and platforms

RDC versions (in-band and Microsoft-supported out-of-band releases)Note In this table, x = not applicable.
Note In this table, almost all users are represented by the scenarios in the table that contain asterisks (*).

The English (United States) version of this security update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

For all supported x86-based versions of Windows Server 2003

For all supported x86-based versions of Windows XP

For all supported x64-based versions of Windows Server 2003 and Windows XP

For all supported IA-64-based versions of Windows Server 2003