Detection and deployment guidance for the July 12, 2005 security release

• Microsoft Windows Update, Microsoft Update, and Office Update
• Versions 1.2.1 and 2.0 of the Microsoft Baseline Security Analyzer (MBSA)
• Software Update Services (SUS) or Windows Server Update Services (WSUS)
• Microsoft Systems Management Server (SMS) together with the Software Update Services Feature Pack and with the Extended Security Update Inventory Tool

This article includes detection and deployment guidance for the security release that is dated July 12, 2005.

As part of an ongoing commitment to provide detection tools and deployment recommendations for security updates, Microsoft is providing this guidance for all updates that are released during a Microsoft Security Response Center (MSRC) release cycle. This guidance contains recommendations that are based on the types of scenarios that may exist in various Microsoft operating system environments. This guidance includes the use of tools such as Windows Update, Office Update, the Microsoft Baseline Security Analyzer (MBSA), the Office Detection Tool, Microsoft Systems Management Server (SMS), the Extended Security Update Inventory Tool, and the Enterprise Update Scan Tool (EST).

Detection and deployment

Environments that use Microsoft Windows Update, Microsoft Update, and Office Update to detect and to deploy security updates

Most of the updates that were released on July 12, 2005 are available through the following Web sites:

• Windows Update
• Microsoft Update
• Office Update

However, these Web sites do not detect or only partially support the following updates:

• Security update 896428 is an update for telnet. Telnet is included with Microsoft Windows Server 2003 and with Microsoft Windows XP. Telnet is also included with versions 2.0, 2.1, 2.2, 3.0 and 3.5 of Microsoft Windows Services for UNIX. The rerelease of this update supports versions 2.0 and 2.1 of Windows Services for UNIX. These services were determined to be vulnerable after the original release of this update. Windows Update and Microsoft Update support the detection and deployment of this update only for the version of telnet that is included with the following operating systems:
  • Windows Server 2003 with Service Pack 1 (SP1)
  • Windows Server 2003
  • Windows XP with Service Pack 2 (SP2)
  • Windows XP with Service Pack 1 (SP1)

Environments that use versions 1.2.1 and 2.0 of MBSA to detect security updates

If you use versions 1.2.1 or 2.0 of the Microsoft Baseline Security Analyzer (MBSA) to detect security updates, you can detect most of the updates that were released on July 12, 2005. The following list details which version of MBSA will detect which updates:

• Security update 896428 is an update for telnet. Telnet is included with Microsoft Windows Server 2003 and with Microsoft Windows XP. Telnet is also included with versions 2.0, 2.1, 2.2, 3.0 and 3.5 of Microsoft Windows Services for UNIX. The rerelease of this update supports versions 2.0 and 2.1 of Windows Services for UNIX. These services were determined to be vulnerable after the original release of this update. Versions 1.2.1 and 2.0 of MBSA support only the versions of telnet that are included with the following operating systems:
  • Windows Server 2003 with SP1
  • Windows Server 2003
  • Windows XP with SP2
  • Windows XP with SP1
  Versions 1.2.1 and 2.0 of MBSA do not support the version of telnet that is included with Windows Services for UNIX. You can use the Enterprise Update Scan Tool to detect this update when telnet was installed by versions 2.0, 2.1, 2.2, 3.0, or 3.5 of Windows Services for UNIX. You can install Windows Services for UNIX on the following operating systems:
  • Windows Server 2003 with SP1
  • Windows Server 2003
  • Windows XP with SP2
  • Windows XP with SP1
  • Windows 2000 with SP4
  • Windows 2000 with SP3
  However, the only vulnerable version of Windows Services for UNIX is the version that is present in Windows 2000 with SP3 and in Windows 2000 with SP4.

For more information about how to obtain the Enterprise Update Scan Tool, click the following article number to view the article in the Microsoft Knowledge Base:

Environments that use Software Update Services or Windows Server Update Services to detect and to deploy security updates

If you use Microsoft Software Update Services (SUS) or Microsoft Windows Server Update Services (WSUS) to detect and to deploy security updates, you can detect most of the updates that were released on July 12, 2005. However, SUS and WSUS do not detect or only partially support the following updates:

• Security update 896428 is an update for telnet. Telnet is included with Microsoft Windows Server 2003 and with Microsoft Windows XP. Telnet is also included with versions 2.0, 2.1, 2.2, 3.0 and 3.5 of Microsoft Windows Services for UNIX. The rerelease of this update supports versions 2.0 and 2.1 of Windows Services for UNIX. These services were determined to be vulnerable after the original release of this update. SUS and WSUS support only the versions of telnet that are included with the following operating systems:
  • Windows Server 2003 with SP1
  • Windows Server 2003
  • Windows XP with SP2
  • Windows XP with SP1
  SUS and WSUS do not support the version of telnet that is included with Windows Services for UNIX. For more information about this version of telnet, see the "Environments that use versions 1.2.1 and 2.0 of MBSA to detect security updates" section.

Environments that use SMS together with the Software Update Services Feature Pack and with the Extended Security Update Inventory Tool to detect and to deploy security updates

If you use Microsoft Systems Management Server (SMS) to detect and to deploy security updates, you can detect all the security updates that were released on July 12, 2005. However, you can fully detect some of the security updates only by using the latest cumulative Extended Security Update Inventory Tool. To obtain this tool, visit the following Microsoft Web site:

Summary of detection and deployment guidance

New security updates

The following table summarizes the detection and deployment guidance for each new security update.

Rereleased security updates

The following table summarizes the detection and deployment guidance for each re-released security update.

Frequently asked questions

What is Microsoft doing to provide guidance about how to deploy these updates?
Microsoft encourages system administrators to join the monthly technical webcast to learn more about security updates. The webcast for these security update airs on July 13, 2005 at 11:00 A.M. Pacific Time. To register, visit the following Microsoft Web site:Is the Enterprise Update Scan Tool cumulative, as the Extended Security Update Inventory Tool is for SMS?
No, the Enterprise Update Scan tool is not cumulative. There are no plans to make the Enterprise Update Scan tool cumulative.

Can I use the Microsoft Baseline Security Analyzer (MBSA) tool to determine whether updates are required?
You can use versions 1.2.1 and 2.0 of MBSA to detect the following security updates that were released in July, 2005:

• 895333
• 901214
• 903144

Versions 1.2.1 and 2.0 of MBSA partially support the following security update:

• 896428

For more information, see the "Environments that use versions 1.2.1 and 2.0 of MBSA to detect security updates" section.

For more information about the programs that the MBSA currently does not detect, click the following article numbers to view the articles in the Microsoft Knowledge Base: If you have installed a program that is listed in the "Affected software" section of a security bulletin, you may have to manually determine whether you must install the security update. For more information about MBSA, visit the following Microsoft Web site:Which security updates require that I use the Enterprise Update Scan Tool together with MBSA to identify vulnerable systems on my network?
The following security update is partially supported by the Enterprise Update Scan Tool together with the MBSA under certain conditions:

• 896428

For more information, see the "Environments that use versions 1.2.1 and 2.0 of MBSA to detect security updates" section.

Can I use Systems Management Server (SMS) to determine whether these updates are required?
Yes. SMS helps detect and deploy these security updates. However, because SMS uses MBSA to detect updates, SMS does not detect updates that MBSA does not detect. For more information about SMS, visit the following Microsoft Web site:To detect all the security updates on Microsoft Windows and on other affected Microsoft products, the Security Update Inventory Tool and the Extended Security Update Inventory Tool are both required.

For more information about the limitations of the Security Update Inventory Tool, click the following article number to view the article in the Microsoft Knowledge Base: SMS also uses the Microsoft Office Inventory Tool to detect the required security updates for Microsoft Office programs such as Microsoft Word.