FYI: Possible issue with KB973904 and Windows 2000

[Inki]

First, my great appreciation for HFSLIP.

I recently made a new Windows 2000 install CD with hotfixes up to January 2010 using HFSLIP 1.7.9.

Everything seems to be fine apart from both MBSA and WU nagging about KB973904/MS09-073 (Vulnerability in WordPad and Office Text Converters) until I install the hotfix manually.

As my typical setup contains several non-critical updates, which may be distracting, I made a trimmed-down demo run with the attached log file, that shows the same symptoms. The source is pre-slipstreamed with Gurgelmeyer's USP 5.1 containing IE 6 and some other stuff that might seem to be missing from the log.

Some additional observations concerning the Windows 2000 Post SP4 hotfix list:

KB951748/MS08-037 has been replaced by a V2 version of the same, and this updated hotfix now also appears to replace KB945553/MS08-020.

One can apparently remove KB976749/MSA 977981 (IE 6 Fix for MS09-054), as it seems to be included in KB976325/MS09-072 (IE 6 Cumulative Security Update). Quoting from MS09-072: "This security update also addresses the vulnerability first described in Microsoft Security Advisory 977981".

Perhaps there may or may not be a case for considering KB955759 (aclayers.dll) and KB976138 (quartz.dll, replaces KB971633/MS09-028), both from MSA 954157 (Indeo codec vulnerability), as WU brings them up as high priority updates.

HFSLIPLOG.zip

[tommyp]

Please check the KB973904 log in the windows folder on the machine where you manually installed it. Maybe it will list what files are replaced when the hotfix is run.

Thanks for the tips on the other hotfixes. I haven't used 2k in a few months now. The 976749 hotfix seems strange. The articles say two different things. Whatever the case is, hfslip will place the latest files into the final sourcess folder.

[Inki]

It seems that after installing the OS from the HFSLIPped CD, relevant files on the machine are updated as single copies in what I guess are "standard locations" for such files:

C:\Program Files\Common Files\Microsoft Shared\TextConv\ contains html32.cnv, msconv97.dll, mswrd632.wpc, mswrd832.cnv, and write32.wpc.

C:\Windows\System32\ contains mswrd6.wpc, mswrd8.wpc, and write.wpc.

However, after installing the hotfix manually, it seems that most of these files can also be found at additional locations, and these new locations match copy entries in KB973904.log, as you cleverly suspected.

KB973904LOG.zip

[tommyp]

I did a little investigating. The files that are copied aren't part of the original source. It's comparible to XP's wordpad.inf though. Whatever the case, wordpad is an optional component. Modifying the code would take a little too much effort for very little payoff.

For now, place that hotfix into HFSVCPACK_SW1 and you'll be ok. It will get installed at T-13.

[Inki]

OK. From what you are saying I get the impression, that rather than fully adapt the hotfix to 2k, they may perhaps have imposed an ad-hoc XP-style file organisation onto 2k instead.

If so, that would seem a bit disappointing and understandably pull the rug from under slipstreaming efforts. Well, hopefully they didn't break anything.

Anyway, thanks for looking into this.

[tommyp]

Yep, looks like msft is just rolling out new and additional binaries to make WU happy. If you don't use wordpad, then you'll be fine without the hotfix. Or, just set up your winnt.sif file to not load the optional component and you'll be OK too.

Actually, the main prob is putting files in the program files folder. Slipstreaming files to there takes lots more legwork than putting them in some windows folder.

If I get time, one day I may roll the change in to keep WU happy for the 2k users. Then again, and it's the more likely case, I probably won't have time to roll it in. HFSLIP ain't paying the bills.