Microsoft Security Advisory (954960)

Purpose of Advisory: The purpose of this advisory is to inform customers of an update to correct a non-security related issue they may experience when attempting to deploy updates through Microsoft Windows Server Update Services 3.0 or Microsoft Windows Server Update Services 3.0 Service Pack 1 to client systems that have Microsoft Office 2003 installed in their environment.

This issue is not a security vulnerability in Microsoft Windows Server Update Services. However, environments that deploy updates through Microsoft Windows Server Update Services will be unable to deploy any updates to client systems.

Advisory Status: Microsoft Knowledge Base Article and associated update have been released to address this issue.

Recommendation: Review the suggested actions and configure as appropriate.

This advisory discusses the following software.

What is the scope of the advisory?
This advisory and the related Microsoft Knowledge Base Article provide additional information on this issue as first described in the WSUS Product Team Blog.

Why did Microsoft update this advisory on August 12, 2008? 
Microsoft updated this advisory to communicate that the updated packages released via the Microsoft Download Center on August 1, 2008 are now also available via Microsoft Update. Customers who have already successfully installed the update do not need to reinstall.

Why did Microsoft update this advisory on August 1, 2008? 
Microsoft updated this advisory and the associated update detailed in Microsoft Knowledge Base Article 954960 due to an issue with the initial release of the update, where it did not properly elevate the necessary privileges required to install the update on Windows Server 2008 systems. Microsoft has corrected this elevation issue and has updated the packages as detailed in Microsoft Knowledge Base Article 954960.

Does the update offered in Microsoft Knowledge Base Article 954960 apply to all supported versions of Microsoft Windows Server Update Services?
The update offered in Microsoft Knowledge Base Article 954960 corrects the issue in Microsoft Windows Server Update Services 3.0 Service Pack 1. If you are using the RTM version of WSUS 3.0, refer to the workaround in the "Workaround" section in Microsoft Knowledge Base Article 954960 to resolve this issue. Customers who use the RTM version of WSUS 3.0 and who do not choose to implement the workaround can upgrade to WSUS 3.0 Service Pack 1. See Microsoft Knowledge Base Article 954960 for more information.

How can I verify if my deployments are impacted by the issue described in this advisory?
Administrators of Microsoft Windows Server Update Services 3.0 installations can identify this issue by reviewing log file entries on either the client or server:

Is this a security vulnerability that requires Microsoft to issue a security update?
No. The inability to install updates from Microsoft Windows Server Update Services 3.0 or Microsoft Windows Server Update Services 3.0 Service Pack 1 to environments that have Microsoft Office 2003 installed is not a security vulnerability.

What Microsoft products are associated with this advisory?
This issue is limited to customers who deploy updates through Microsoft Windows Server Update Services 3.0 or Microsoft Windows Server Update Services 3.0 Service Pack 1, and have Microsoft Office 2003 installed in their environments.

Note This advisory also applies to Microsoft software that ship with or are built on top of Microsoft Windows Server Update Services 3.0 or Microsoft Windows Server Update Services 3.0 Service Pack 1. Microsoft Small Business Server 2003 by default includes Windows Server Update Services 2.0 and is only affected if it has been upgraded to Microsoft Windows Server Update Services 3.0 or Microsoft Windows Server Update Services 3.0 Service Pack 1. System Center Essentials and System Center Configuration Manager 2007 are the only Microsoft software that consume the Microsoft Windows Server Update Services catalog and thus are also affected when used to deploy updates.

This is a security advisory about a non-security update. Isn’t that a contradiction?
Security advisories address security changes that may not require a security bulletin but may still affect a customer’s overall security. Security advisories are a way for Microsoft to communicate security-related information to customers about issues that may not be classified as vulnerabilities and may not require a security bulletin, or about issues for which no security bulletin has been released. In this case, Microsoft is communicating an issue that affects your ability to perform updates, including security updates. Therefore, this advisory does not address a specific security vulnerability; rather, it addresses your overall security.

Review the Microsoft Knowledge Base Article that is associated with this advisory.

Microsoft encourages customers to install this update. Customers who are interested in learning more about this update should review Microsoft Knowledge Base Article 954960.