Did Microsoft ever release a win-98 patch for MS06-024 or MS06-026?

January 20, 2010

If you read the security bulletin for MS06-024 (Vulnerability in Windows Media Player Could Allow Remote Code Execution 917734)

http://www.microsoft.com/technet/security/...n/MS06-024.mspx

Microsoft says the usual thing about win-98 that we see in most bulletins - that it tries to avoid making a direct statement about the *actual* applicability of the bulletin to win-98: "Review the FAQ section of this bulletin for details about these operating systems." It's in the FAQ that we typically read this:

----------

How does the extended support for Windows 98, Windows 98 Second Edition, and Windows Millennium Edition affect the release of security updates for these operating systems? Microsoft will only release security updates for critical security issues. Updates for non-critical security issues are not offered during this support period.

-----------

Which doesn't really answer the question as to if win-98 is affected (critically or not) by the bulletin. In this case, the FAQ does not make any further mention of win-98 (which is typical of most bulletins). So perhaps we can conclude that MS06-024 does not "critically" affect win-98? You'd think so. However, in this case, when you open more of the bulletin tree, you will find this in the "FAQ for Windows Media Player PNG Vulnerability - CVE-2006-0025" section:

------------------

Are Windows 98, Windows 98 Second Edition, or Windows Millennium Edition critically affected by this vulnerability?

Yes. This vulnerability is critical for Windows Media Player 9 on Windows 98 Second Edition, and Windows Millennium Edition. Critical security updates for these platforms may not be available concurrently with the other security updates provided as part of this security bulletin. They will be made available as soon as possible following the release. When these security updates are available, you will be able to download them only from the Windows Update Web site. For more information about severity ratings, visit the following Web site.

-----------------

So it seems that Microsoft was promising a future win-98 hot-fix or patch for MS06-024. I'm asking if it was ever delivered.

And ditto when it comes to MS06-026:

http://www.microsoft.com/technet/security/...n/MS06-026.mspx

Useful link: http://www.securiteam.com/products/W/Windows_98.html

**cluberti** · January 20, 2010

MS06-024 was only released for Windows 2000 and XP/2003, and MS06-026 was available for Win98 and WinME at one point but it's no longer publicly available (it was removed around July of 2007).

**triger49** · January 20, 2010

Correct me if I'm wrong ...but I think this is it...

http://download.windowsupdate.com/msdownlo...19a2c3df108.exe

I just downloaded it

Jake

**lightning slinger** · January 20, 2010

FWIW,

wmp.dll included in 917734 is version 9.0.0.3349

MS07-047 replaces MS06-024 see

http://www.microsoft.com/technet/security/...n/ms07-047.mspx

therefore 936782 replaces 917734 see

http://erpman1.tripod.com/iewmpupd.html

wmp.dll included in 936782 is version 9.0.0.3354

MP9URP9X currently ships with version 9.0.0.4504

HTH

Edited January 20, 2010 by lightning slinger

**Prozactive** · January 20, 2010

The latest version of MP9URP9X from MDGx updated wmp.dll to 9.00.00.4507 (from Windows XP SP3 in KB973540).

Reference:

http://support.microsoft.com/kb/973540

HTH

Edited January 20, 2010 by Prozactive

**cluberti** · January 20, 2010

I stand corrected - MS06-024 I guess did have a package. I went through all of my old KB article saves, and there was never a reference to a Win9x package, but I guess one did exist for a time. Wierd .

**lightning slinger** · January 20, 2010

The latest version of MP9URP9X from MDGx updated wmp.dll to 9.00.00.4507 (from Windows XP SP3 in KB973540).

Yes you're correct Prozactive, as usual, I must have missed the Dec.2009 package on this 98SE box, must double check my main 98SE2ME box also just to make sure I have the latest there also.

**Prozactive** · January 20, 2010

Thanks. I wasn't trying to be a smart-aleck. I was just a little confused b/c I recently loaded the updated version of MP9URP9X and I thought it updated wmp.dll to a later version. So I double-checked to make sure. I agree.. it's an aggravating job keeping your computers up-to-date and maintaining version control. Several years ago I started maintaining changelogs to help with this task but it's still a time-consuming tedious job.