MS09-013: Vulnerabilities in Windows HTTP services could allow remote code execution

Known issues with this security update

• In certain scenarios, after you install this security update, the Logon Agent for certain versions of Websense Web Filter or Websense Web Security may no longer work correctly to identify users. WebSense has made an update available that resolves this issue. We recommend that customers that are affected by this issue contact their software vendor for support and an update.
  
  The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.
  
• When a client tries to connect to an HTTP server that is running on a local system by using NTLM authentication and IPv6 addresses, the client receives the following error message:
  
  
  Connection Denied
  
  This problem occurs because of a known issue in the underlying NTLM provider. The provider does not recognize IPv6 addresses in the local context. To work around the issue, use one of the following methods.
  
  ImportantThis section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
  322756 How to back up and restore the registry in Windows
  
  For more information about this registry configuration, click the following article number to view the article in the Microsoft Knowledge Base:
  
  896861 You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or IIS 6
  

  Method 1: Use a single host name for all the variants of the IPv6 addresses

  To do this, follow these steps:
  
  
  1. In Notepad, open the following file:
     %systemroot%\System32\drivers\etc\hosts
  2. Type the following entry for each IPv6 address to be used:
     <IPv6Address> <hostname>
  3. Save and then close the host file.
  4. In the registry, specify each host name that you typed in step 2. To do this, follow these steps:
     
     
     1. Click Start, click Run, type regedit, and then click OK.
     2. Locate and then click the following subkey:
        
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
        
     3. Right-click MSV1_0, point to New, and then click Multi-String Value.
     4. Type BackConnectionHostNames, and then press ENTER.
     5. Right-click BackConnectionHostNames, and then click Modify.
     6. In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.
     7. Exit Registry Editor, and then restart the computer.

  Method 2: Use different host name aliases for all the different variants of the IPv6 addresses

  To do this, follow these steps:
  
  
  1. In Notepad, open the following file:
     %systemroot%\System32\drivers\etc\hosts
  2. Type the following entries for each IPv6 address to be used:
     IPv6Address1 hostnameAlias1
     IPv6Address2 hostnameAlias2
  3. Save and then close the host file.
  4. In the registry, specify each host name that you typed in step 2. To do this, follow these steps:
     
     
     1. Click Start, click Run, type regedit, and then click OK.
     2. Locate and then click the following subkey:
        
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
        
     3. Right-click MSV1_0, point to New, and then click Multi-String Value.
     4. Type BackConnectionHostNames, and then press ENTER.
     5. Right-click BackConnectionHostNames, and then click Modify.
     6. In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.
     7. Exit Registry Editor, and then restart the computer.
  5. Use the host name that is used in step 2 to open the HTTP connection.