MS09-044: Description of the security update for Remote Desktop Client Version 5.1: August 11, 2009

Microsoft has released security bulletin MS09-044. To view the complete security bulletin, visit one of the following Microsoft Web sites:

• Home users:
  http://www.microsoft.com/security/updates/bulletins/200908.aspx
  Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:
  http://update.microsoft.com/microsoftupdate
• IT professionals:
  http://www.microsoft.com/technet/security/bulletin/ms09-044.mspx

How to obtain help and support for this security update

Help installing updates: Support for Microsoft Update

Security solutions for IT professionals: TechNet Security Troubleshooting and Support

Help protect your computer that is running Windows from viruses and malware: Virus Solution and Security Center

Local support according to your country: International Support

Security update 958470 updates the following binaries: Note The files are updated only if the files were already present on the client computer.

Security update 958470 updates the following binaries on the following operating systems: Note that in specific deployments on out-of-box versions of the RDC client, files may be renamed during installation. The file names listed in the "File information" in this article are the original names prior to installation.

Frequently asked questions

Question Is RDC 5.0 fixed in on Windows 2000?
Answer Yes, the Windows 2000 RDC is fixed by upgrading the RDC version from 5.0 to 5.1. Therefore, there are user interface changes in the RDC client. Also, RDC 5.1 contains some additional functionality, including "redirection."

Question My RDC client is in a custom location. Will it be updated?
Answer Because of the properties of the older RDC installer, RDC clients that are located in nonstandard locations may not be updated correctly. To address this issue, we recommend that you uninstall the client, reinstall the client by using the default installation properties, and then install the security update.

Question Why do I have to install both security update 958471 and security update 958470 when I use Windows 2000 with the in-box RDC 5.0 client?
Answer Installing security update 958471 upgrades the in-box RDC 5.0 component to a version of RDC 5.1 that includes this security update. Installing security update 958470 makes no further changes to any binaries, but it still deploys a killbit that prevents the old ActiveX control from being instantiated from Internet Explorer. Therefore, we recommend that you install of both security updates on affected Windows 2000 systems.

Note Remote Desktop Connection 5.0 is also known as Terminal Services Client and is sometimes described as RDP because it is the implementation of Remote Desktop Protocol on that system.

Question After I install security updates 958470 and 958471 on a Windows 2000-based computer, my RDC user interface changes significantly. Why?
Answer By default, Windows 2000-based computers use RDC 5.0. After you install security update 958471, the RDC client is upgraded to RDC 5.1. The newer version of RDC has following changes, compared to RDC 5.0:

• Better error handling
• New user interface
• The ability to use the Remote Desktop Client by using the connection file
• New functionality, including "redirection"

Question After I install security update 958471 or security update 958470 in Windows 2000, I experience issues with older applications.
Answer You may experience limited application-specific compatibility issues because of user interface changes that are caused by the upgrade from RDC 5.0 to RDC 5.1.

Question After I installed security update 958470 or 958471, which upgraded my system from RDC 5.0 to RDC 5.1, I manually reinstalled RDC 5.0. Will I be re-offered the update?
Answer Security updates 958470 and 958471 upgrade the computer to RDC 5.1 from RDC 5.0. If you explicitly reinstall RDC 5.0 after deployment, this update will not be re-offered. However, we recommend that you manually download the security update and reinstall it. Note that Microsoft no longer makes RDC 5.0 available for download.

Question I have RDC 5.0 through Terminal Services Advanced Client (TSAC). However, security update 958471 is not offered to me. Why?
Answer The RDC 5.0 version that is installed through TSAC is updated by security update 958470. Therefore, security update 958470 is offered to you.

Question Before I installed the security update, I had the RDC 5.1 version of Msrdp.ocx. After I installed the security update, I do not see the RDC 5.1 version of Msrdp.ocx. Why?
Answer After you install this security update, the RDC 5.1 version of Msrdp.ocx is upgraded to the RDC 5.2 version of Msrdp.ocx.

Question If I have an application that deploys the Remote Desktop Web Connection binaries in non-default locations, will this security update patch my installation?
Answer This update updates the Microsoft Remote Desktop Web Connection binaries in standard locations. If your redistributed Microsoft Remote Desktop Web Connection binaries are in a custom location, you will have to update custom location with the updated Microsoft Remote Desktop Web Connection binaries.

Question I installed the security update, and now if I try to use ActiveX component of MSTSC (Msrdp.ocx), I cannot connect. Why?
Answer The scenario is broken (see Figure 1) because server is not updated. Therefore, the server is still pushing the vulnerable Msrdp.ocx file to the clients. Before you install the security update, the client computer does not have the ActiveX control (Msrdp.ocx). After you install the security update, the vulnerable ActiveX ClassIds were blocked. Therefore, if you try to use the vulnerable ActiveX Msrdp.ocx by using Internet Explorer, you cannot connect until the client computer receives the new Msrdp.ocx file. To resolve the problem, follow these steps:

• Reinstall the security update on the client workstation to update the older version of the Msrdp.ocx file that was downloaded from the server.
  
  Note The Msrdp.ocx file is updated only in the standard locations.
• Ask your Web server administrators to update the server-side Msrdp.cab file by using the security update. Administrators should be aware that the update updates only Msrdp.cab files that are found in the standard locations. To update Msrdp.cab files that are in custom locations, follow these steps:
  1. Extract the update (KB) by using the KB /x:<path> command.
  2. Copy the Msrdp.cab from <location> to the custom path.

Figure 1: The Remote Desktop Web connection will not work until the client receives an updated Msrdp.ocx file. Note that Windows Update will offer the update automatically if the vulnerable Msrdp.ocx file is available in the standard location on the computer. For more information, visit the following Microsoft Web site: * This scenario works if you have RDC 6.0 or a later version installed on the client (workstation) computer.

Question After I install the security update, Internet Explorer 6 and Internet Explorer 7 do not install the ActiveX component on my computer. Why?
Answer Before you install the security update, the computer does not have the ActiveX control (Msrdp.ocx). After the security update is installed, the vulnerable ActiveX ClassIds are killbitted. Therefore, after you install the update, when you try to use the vulnerable ActiveX control (Msrdp.ocx) by using Internet Explorer, you cannot connect until the client computer receives the new Msrdp.ocx file from Windows Update. There are two ways to obtain the latest Msrdp.ocx file:

• From the Windows Update Web site. However, Windows Update offers the updated version of the Msrdp.ocx file automatically if the client has the vulnerable Msrdp.ocx file in "%Windir%\Download Program Files."
• By installing the update from the Terminal Services Web server. However, the update replaces the Msrdp.cab file only in the standard locations.
  • To update the Msrdp.cab file in a custom location, you must manually extract the update. To do this, type the following command at a command prompt:
    Packagename /x <path>
    For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    832475 Description of the new features in the package installer for Windows software updates
  • Copy the Msrdp.cab file from <location> to the custom path.

Question After I install the update, I do not have the Msrdp.ocx file. Why?
Answer This update updates only the files that were present on the computer before you installed the update. Therefore, if the Msrdp.ocx file was not on the Windows XP SP2-based computer before you installed the update, the Msrdp.ocx file is not downloaded to or installed on the computer. When the client obtains the Msrdp.ocx file, Windows Update reoffers the update to the client computer.

Question How to I determine I have the Msrdp.ocx file on my system?
Answer To determine whether the Msrdp.ocx file exists in the default location, run the following command at a command prompt:

Question After I install the update, I do not have the Msrdp.cab. Why?
Answer This update updates only the files that were present on the computer before you installed the update. For example, if you did not have the Msrdp.cab file on the XP SP2-based computer before you installed the update, the Msrdp.cab file is not installed on the client computer.

Question I have an old Msrdp.cab file that is being redistributed from my Terminal Server Web Server computer. Are my clients vulnerable?
Answer Your updated client computers will not be vulnerable even if the server is not updated. We strongly recommend that you apply the update on the Terminal Services Web Server so that the redistribution of vulnerable Msrdp.ocx files can be prevented to any clients that are not updated.

Question Why is security update 958470 offered to my Windows 2000-based computer even when RDP is not installed?

Answer Security update 958470 is offered to Windows 2000-based computers regardless of whether RDP is installed or not. If RDP is not installed, security update 958470 will still deploy killbits to prevent invocation of the affected RDP ActiveX control, but it will not replace any binary.

KB offer matrix based on the RDC version and platforms

RDC versions (in-band and Microsoft-supported out-of-band releases)Note In this table, x = not applicable.
Note In this table, almost all users are represented by the scenarios in the table that contain asterisks (*).

The English (United States) version of this security update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows 2000 file information

For all supported editions of Microsoft Windows 2000 Service Pack 4

Windows XP file information

• The files that apply to a specific milestone (RTM, SPn) and service branch (QFE, GDR) are noted in the "SP requirement" and "Service branch" columns.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. QFE service branches contain hotfixes in addition to widely released fixes.
• In addition to the files that are listed in these tables, this software update also installs an associated security catalog file (KBnumber.cat) that is signed with a Microsoft digital signature.

For all supported x86-based versions of Windows XP

For all supported x64-based versions of Windows XP