Re: MS02-047 + Terminal Service Web Client

From: Alex K. Angelopoulos \(MVP\) (aka@mvps.org)
Date: 09/13/02 

From: "Alex K. Angelopoulos \(MVP\)" <aka@mvps.org>
Date: Fri, 13 Sep 2002 03:39:24 -0500

Too late I'm sure for most people who had problems with this, but I put
together an MSI installer for the redistributable control. It had only
light testing since I don't have a big LAN I can "test" deploy it on.
http://dev.remotenetworktechnology.com/files/tsweb.zip 

--
Please respond in the newsgroup so everyone may benefit.
 http://dev.remotenetworktechnology.com
 ----------
 Subscribe to Microsoft's Security Bulletins:
 http://www.microsoft.com/technet/security/bulletin/notify.asp
"Bill Sanderson" <bill_NoSpamSanderson@msn.com> wrote in message
news:OKRJRs7UCHA.2740@tkmsftngp10...
>
>
> Torgeir Bakken wrote:
> > PaulD wrote:
> >
> >> I am evaluating the IE6 security update MS02-047 and have
> >> installed on my and 1 other PC. All my existing TSWeb
> >> connections now fail.
> >>
> >> I have researched this and found and read Q328002 and
> >> understand how to set up our web server to deliver the
> >> updated OCX control. I am not sure that I will do so
> >> however.
> >>
> >> My problem is this: Our XP client machines are not set up
> >> to allow non administrators ( we have an NT4 Domain )to
> >> install these controls. I have no desire to log onto or
> >> change the local security on over 100 XP machines to
> >> allow our users to install the new control however I also
> >> would prefer we have the latest updates installed. I also
> >> don't want to have to change security at the Domain
> >> level. What do I do?
> >>
> >> BTW there is no reference to this as an implication of
> >> installing this latest update anywhere on Microsoft's
> >> download page.
> >
> > Hi
> >
> > The references are in the  Security Bulletins...
> >
> >
> > This is from the bulletin describing the IE6 security patch
(Q323759):
> >
> > From Microsoft Security Bulletin MS02-047
> > Title: Cumulative Patch for Internet Explorer (Q323759)
> > Date: August 22, 2002
> > Software: Internet Explorer
> > http://www.microsoft.com/technet/security/bulletin/MS02-047.asp
> >
> > <qoute>
> > and customers who use TSAC and have not already installed
> > the patch provided in MS02-046 should do so before
> > installing this patch.
> > </qoute>
> >
> >
> > This is from the bulletin describing the server side security
update:
> >
> > From Microsoft Security Bulletin MS02-046
> > Title: Buffer Overrun in TSAC ActiveX Control Could Allow
> > Code Execution(Q327521)
> > Date: August 22, 2002
> > Software: Microsoft Terminal Services Advanced Client
> > (TSAC) ActiveX control
> > http://www.microsoft.com/technet/security/bulletin/MS02-046.asp
> >
> > <qoute>
> > The updated control will be delivered to users through the
> > normal installation process described above. That is, the
> > next time the user visits a web site that offers terminal
> > services and has installed the patch, the updated control
> > will be delivered to the user&#8217;s system. (On the other
> > hand, if the web site has not installed the patch, the
> > user will be unable to use terminal services. This is the
> > correct behavior, since the older version of the control
> > does represent a security exposure if used).
> > </qoute>
>
> But can this updated control be delivered to the user if only Admin
level
> users are allowed to install such controls?
>
> This was the point of the original post--in a large installation where
> permissions are set to prevent users from installing ActiveX controls,
how
> can this client-side distribution of the ActiveX control be managed
> centrally?
>
>

Relevant Pages

  • Re: Microsoft notice on W32.Slammer
    ... >PSS Security Response Team Alert - New Worm: ... >1434 utilizing a vulnerability that was patched in Microsoft Security ... > Microsoft, however, recommends that customers install the most recent ... >cumulative security patch for Microsoft SQL Server 2000 which is Microsoft ...
    (microsoft.public.sqlserver.security)
  • Re: Outlook and SP3
    ... the best thing to do is not to install the patch. ... Sue Mosher, Outlook MVP ... Security is great, don't get me wrong, ...
    (microsoft.public.outlook.general)
  • Re: Check out the security patch from Microsoft
    ... URL to the Microsoft site, ... touch any "patch" found in a public newsgroup. ... this is the latest version of security update, ... Customers should install the patch at the earliest opportunity. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • XP SECURITY DAOWNLAD
    ... >downloaded the latest security patches 2 days ago. ... >can get into any YAHOO games nor my YAHOO Dominoes ... Problems with Latest IE 6.0 Patch ... I do not recommend deciding never to install this patch. ...
    (microsoft.public.windowsxp.general)
  • Patch Hype??...Check this email header....
    ... Subject: Security Update ... Cumulative Patch" update which fixes ... Install now to help maintain the security of your computer ... Thank you for using Microsoft products. ...
    (microsoft.public.security.virus)