Microsoft Security Advisory (967940)

Purpose of Advisory: To provide clarification and notification of the availability of a non-security update to correct the functionality of the NoDriveTypeAutoRun registry key.

Advisory Status: Microsoft Knowledge Base Article and associated update were released.

Recommendation: Review the referenced Knowledge Base Article and apply the appropriate update.

This advisory discusses the following software.

*In order to take advantage of the registry key settings that disable Autorun, customers running Windows Vista and Windows Server 2008-based systems must install the security update provided in the MS08-038 (950582) security bulletin.

What is the scope of the advisory?
This advisory provides notification that the non-security update will also be deployed via automatic updating and will continue to be offered in Microsoft Knowledge Base Article 967715. This update affects the software that is listed in the Overview section.

How do I disable Autorun? 
There are two requirements for a system to disable Autorun capabilities; have one of the updates discussed in this advisory installed and have the appropriate registry key value set for the features of Autorun that are intended to be disabled. See Microsoft Knowledge Base Article 967715 for information about how these updates are distributed as well the specific values required to disable Autorun capabilities for the different versions of the operating systems.

Does this update change my current Autorun settings? 
No. The update does not modify the current Autorun settings on your system. Instead, the update allows users to properly enforce Autorun settings as desired.

Is there a change in user experience after this update is installed? 
After one of the updates discussed in this advisory has been installed, users might notice Autorun features for network drives no longer function. This is because, by default, Autorun on network drives is set to disabled in the registry, and after the update is installed, the previously set registry key to disable Autorun on network drives will be properly enforced. This is the only functionality that will change by default after the update is installed. Users will still need to update the registry key values to disable Autorun functionality for USB and CD-ROM drives.

Is this a security vulnerability that requires Microsoft to issue a security update?
No. Disabling the Autorun feature is an optional configuration that some customers may choose to deploy. This feature is not appropriate for all customers. For more information about this feature and how to appropriately configure it, see Microsoft Knowledge Base Article 967715.

This is a security advisory about a non-security update. Isn’t that a contradiction?
Security advisories address security changes that may not require a security bulletin but may still affect customer’s overall security. Security advisories are a way for Microsoft to communicate security-related information to customers about issues that may not be classified as vulnerabilities and may not require a security bulletin, or about issues for which no security bulletin has been released. In this case, we are communicating the availability of an update that affects your ability to perform subsequent updates, including security updates. Therefore, this advisory does not address a specific security vulnerability; rather, it addresses your overall security.

If systems already have the update offered in Knowledge Base Article 953252 installed does this update need to be installed as well?
No. Systems that have installed the update offered in Microsoft Knowledge Base Article 953252 will not need the update offered in Microsoft Knowledge Base Article 967715. Systems with the update offered in Microsoft Knowledge Base Article 953252 installed already have the version of the update that correctly respects the registry keys values to disable Autorun. The update that is offered in Microsoft Knowledge Base Article 967715 contains the same update, but was deployed via automatic updating.

Why are there two places to get this update?
These updates are available in two places due to the way the updates were originally offered. The updates that were offered in Microsoft Knowledge Base Article 953252 were not available from automatic updating (including Automatic Updates, Windows Update, and Windows Server Update Services) and therefore required users to manually find these updates and install them. The updates that are offered in Microsoft Knowledge Base Article 967715 contain the same updates that correctly respect the registry keys values to disable Autorun as in Microsoft Knowledge Base Article 953252, but are being distributed via automatic updating.

If systems already have the updates from Knowledge Base Article 953252 installed will they also be offered updates from Knowledge Base Article 967715?
No. Automatic updating will check to see if the system already contains the fix that correctly respects the registry keys values to disable Autorun capabilities as offered by Microsoft Knowledge Base Article 953252. If the fixed code is present, users will not be reoffered the updates from Microsoft Knowledge Base Article 967715 because, although Microsoft Knowledge Base Article 953252 was not deployed via automatic updating, both the updates contain the same changes.

Do the updates offered in Knowledge Base Article 953252 or Knowledge Base Article 967715 disable Autorun capabilities?
No. The updates that are offered correctly respect the registry keys values to disable Autorun capabilities. These updates do not change the registry key values and will continue to respect values that were already set before either of these updates were installed. If the registry values were not set before installing these updates then the registry key settings will have to be set appropriately in order to disable Autorun capabilities.

Can group policy be used to change the registry settings in order to disable Autorun functionality?
Yes. Systems that have the update installed can manually set the registry Key settings or use group policy in an enterprise environment to disable Autorun capabilities. For more information on how to set these registry settings and the specific values depending on the operating system see Microsoft Knowledge Base Article 967715.

Where are the updates for Windows Vista and Windows Server 2008?
The fix to correct the issue described in this advisory for Windows Vista and Windows Server 2008 was rolled into the update provided by security bulletin MS08-038. In order to take advantage of the registry key settings that disable Autorun, customers running Windows Vista and Windows Server 2008-based systems must install the security update provided in the MS08-038 (950582) security bulletin.