Microsoft Security Bulletin MS04-016


    Vulnerability in DirectPlay Could Allow Denial of Service (839643)

*Issued:* June 8, 2004
*Version:* 1.0


      Summary

*Who should read this document:* Customers who use Microsoft® Windows®

*Impact of Vulnerability:*  Denial of Service

*Maximum Severity Rating: *Moderate

*Recommendation: *Customers should consider applying the security update.

*Security Update Replacement: *None

*Caveats: *None

*Tested Software and Security Update Download Locations:*

*Affected Software: *

?

Microsoft Windows 2000 Service Pack 2, Microsoft Windows 2000 Service
Pack 3, Microsoft Windows 2000 Service Pack 4 ? Download the update


?

Microsoft Windows XP and Microsoft Windows XP Service Pack 1 ? Download
the update


?

Microsoft Windows XP 64-Bit Edition Service Pack 1 ? Download the update


?

Microsoft Windows XP 64-Bit Edition Version 2003 ? Download the update


?

Microsoft Windows Server? 2003 ? Download the update


?

Microsoft Windows Server 2003 64-Bit Edition ? Download the update


?

Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and
Microsoft Windows Millennium Edition (Me) ? Review the FAQ section of
this bulletin for details about these operating systems.

*Non-Affected Software:*

?

Microsoft Windows NT® Workstation 4.0 Service Pack 6a

?

Microsoft Windows NT Server 4.0 Service Pack 6a

?

Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6

*Tested Microsoft Windows Components:*

*Affected Components:*

?

Microsoft DirectX® 7.0a, 7.1, 8.1, 8.1a, 8.1b, 8.2, 9.0, 9.0a, 9.0b on
Windows 98, Windows 98 Second Edition, Windows Millennium Edition -
Review the FAQ section of this bulletin for details about these
operating systems.

?

Microsoft DirectX 8.0, 8.0a, when installed on Windows 2000 ? Download
the update


?

Microsoft DirectX 8.1, 8.1a, 8.1b when installed on Windows 2000 ?
Download the update


?

Microsoft DirectX 8.2 when installed on Windows 2000, or Windows XP ?
Download the update


?

Microsoft DirectX 9.0, 9.0a, 9.0b when installed on Windows 2000,
Windows XP, or Windows Server 2003 ? Download the update


*Non-Affected Components:*

?

Microsoft DirectX 5.2 on Windows 98

?

Microsoft DirectX 6.1 on Windows 98 Second Edition

?

Windows Media Player 6.4 or Internet Explorer 6 Service Pack 1 when
installed on Microsoft Windows NT 4.0

?

Windows Media Player 6.4 or Internet Explorer 6 Service Pack 1 when
installed on Microsoft Windows NT 4.0, Terminal Server Edition

The software in this list has been tested to determine if the versions
are affected. Other versions either no longer include security update
support or may not be affected. To determine the support lifecycle for
your product and version, visit the following Microsoft Support
Lifecycle Web site .

Top of section Top of section



    General Information





      Executive Summary
      



*Executive Summary:*

This update resolves a newly-discovered, privately reported
vulnerability. A denial of service vulnerability exists in the
implementation of the IDirectPlay4 application programming interface
(API) of Microsoft DirectPlay because of a lack of robust packet
validation. The vulnerability is documented in the Vulnerability Details
section of this bulletin.

If a user is running a networked DirectPlay application, an attacker who
successfully exploited this vulnerability could cause the DirectPlay
application to fail. The user would have to restart the application to
resume functionality.

Microsoft recommends that customers should consider applying the
security update.

*Severity Ratings and Vulnerability Identifiers:*

Vulnerability Identifiers Impact of Vulnerability Windows 98, 98 SE, Me
Windows 2000 Windows XP Windows Server 2003

DirectPlay Vulnerability - CAN-2004-0202


Denial of Service

Not Critical

Moderate

Moderate

Moderate

This assessment  is based
on the types of systems that are affected by the vulnerability, their
typical deployment patterns, and the effect that exploiting the
vulnerability would have on them.

Top of section Top of section





      Frequently asked questions (FAQ) related to this security update
      



*How does the extended support for Windows 98, Windows 98 Second
Edition, and Windows Millennium Edition affect the release of security
updates for these operating systems?*
Microsoft will only release security updates for critical security
issues. Non-critical security issues are not offered during this support
period. For more information about the Microsoft Support Lifecycle
policies for these operating systems, visit the following Web site


For more information about severity ratings, visit the following Web
site .

*Are Windows 98, Windows 98 Second Edition, or Windows Millennium
Edition critically affected by any of the vulnerabilities that are
addressed in this security bulletin?*
No. None of these vulnerabilities are critical in severity on Windows
98, on Windows 98 Second Edition, or on Windows Millennium Edition.

*Can I use the Microsoft Baseline Security Analyzer (MBSA) to determine
if this update is required?*
MBSA does not currently support the detection of DirectX. For detailed
information about the programs that MBSA currently does not detect, see
Microsoft Knowledge Base Article 306460
. For
more information about MBSA, visit the MBSA Web site
.

*Can I use Systems Management Server (SMS) to determine if this update
is required?*
SMS uses MBSA for detection. This update is not detected by MBSA.
However, the file and registry key information that is available in this
bulletin can be used to write specific file and registry key collection
queries in SMS to detect vulnerable computers. For information about
SMS, visit the SMS Web site .

You can deploy this update using Inventory and Software Distribution
 feature of SMS.

Top of section Top of section





      Vulnerability Details
      







        DirectPlay Vulnerability - CAN-2004- 0202:
        



A denial of service vulnerability exists in the IDirectPlay4 Application
Programming Interface (API) of Microsoft DirectPlay. Applications that
implement this API are typically network-based multi-player games. An
attacker who successfully exploited this vulnerability could cause the
application to fail.





          Mitigating factors for DirectPlay Vulnerability - CAN-2004-
          0202: 



?

Windows NT 4.0 is not affected by this vulnerability.

?

Only the version 4 interfaces are affected by this vulnerability. If an
application is using the version 8 interfaces, it is not affected. Newer
games and applications are designed by using the version 8 interfaces.

?

For an attack to be successful, a system would need to be actively
running a DirectPlay game.

?

Because DirectPlay is a network protocol that is designed to allow
multi-player games, users who are playing games that do not use the
version 4 interfaces of DirectPlay are not vulnerable to an attack.

?

Firewall best practices and standard default firewall configurations can
help protect networks from attacks that originate outside the enterprise
perimeter. Best practices recommend that systems that are connected to
the Internet have a minimal number of ports exposed.

Top of section Top of section





          Workarounds for DirectPlay Vulnerability - CAN-2004- 0202:
          



Microsoft has tested the following workarounds. While these workarounds
will not correct the underlying vulnerability, they help block known
attack vectors. When a workaround reduces functionality, it is
identified below.

*Do not run games or applications that are coded with the Version 4
DirectPlay APIs.*

Newer games and applications are typically coded by using the version 8
DirectPlay APIs. Although a complete list of games and applications that
use the less recent DirectPlay 4 APIs is not currently available, these
items are typically older computer games. The newer versions are not
vulnerable.

Top of section Top of section





          FAQ for DirectPlay Vulnerability - CAN-2004- 0202:
          



*What is the scope of the vulnerability?*
This is a denial of service
 vulnerability in the
IDirectPlay4 API of Microsoft DirectPlay. Only the version 4 interfaces
are affected by this vulnerability. Applications that implement these
APIs are typically network-based multi-player games. An attacker who
successfully exploited this vulnerability could cause the application to
fail.

*What causes the vulnerability?*
The implementation of the IDirectPlay4 APIs within DirectPlay does not
perform robust packet validation.

*What is DirectPlay?*
DirectPlay is a network protocol that shipped with Microsoft DirectX to
help game developers create multi-player networked games without having
to implement sophisticated network protocols. The version 4
implementation affected by this vulnerability is comprised of a set of
three API interfaces. These interfaces include IDirectPlay4Server,
IDirectPlay4Client, and IDirectPlay4Peer. Each of these interfaces
launches network code which must be invoked for a system to be
vulnerable to attack.

*What is DirectX?*
Microsoft DirectX  is a group of technologies that is
designed to make Windows-based computers an ideal platform for running
and displaying applications that are rich in multimedia elements such as
full-color graphics, video, 3-D animation, and surround sound. DirectX
is comprised of a set of low-level APIs that are used by Windows
programs for multimedia support. The vulnerability covered in this
update is in the implementation of the IDirectPlay4 APIs of the
DirectPlay technology.

*What might an attacker use the vulnerability to do?*
An attacker who successfully exploited this vulnerability could cause
the DirectPlay application to fail, which would interrupt its normal
operation. The user would have to restart the application for
functionality to resume.

*Who could exploit the vulnerability?*
Any anonymous user who could locate a system that is running a version 4
implementation of a DirectPlay-based application, establish a connection
and deliver a malformed packet to the affected system could try to
exploit this vulnerability.

*How could an attacker exploit the vulnerability?*
An attacker could exploit the vulnerability by creating a malformed
packet, establishing a connection and sending the packet to an affected
system, which could then cause the DirectPlay application to fail.

*What systems are primarily at risk from the vulnerability?*
Because the affected component is within the DirectPlay network
technology, systems that are used for multi-player network gaming are
primarily at risk from this vulnerability.

*Are Windows 98, Windows 98 Second Edition or Windows Millennium Edition
critically affected by this vulnerability?*
No. Although Windows Millennium Edition does contain the affected
component, the vulnerability is not critical. For more information about
severity ratings, visit the following Web site
.

*What does the update do?*
The update removes the vulnerability by implementing more robust packet
validation.

*When this security bulletin was issued, had this vulnerability been
publicly disclosed?*
No. Microsoft had not received any information indicating that this
vulnerability had been publicly disclosed when this security bulletin
was originally issued.

*When this security bulletin was issued, had Microsoft received any
reports that this vulnerability was being exploited?*
No. Microsoft had not received any information indicating that this
vulnerability had been publicly used to attack customers and had not
seen any examples of proof of concept code published when this security
bulletin was originally issued.

Top of section Top of section

Top of section Top of section

Top of section Top of section





      Security Update Information
      



*Installation Platforms and Prerequisites:*

For information about the specific security update for your platform,
click the appropriate link:





        Windows Server 2003 (all versions)
        



*Prerequisites*
This security update requires a released version of Windows Server 2003.

*Inclusion in Future Service Packs:*
The update for this issue will be included in Windows Server 2003
Service Pack 1.

*Installation Information*

This security update supports the following setup switches:

      */help                 *Displays the command line options

*Setup Modes*

      */quiet  *            *  *Quiet mode (no user interaction or display)

      */passive*            Unattended mode (progress bar only)

*      /uninstall*          Uninstalls the package

*Restart Options *

      */norestart*          Do not restart when installation is complete

      */forcerestart*      Restart after installation

*Special Options *

      */l*                        Lists installed Windows hotfixes or
update packages

      */o*                       Overwrite OEM files without prompting

      */n*                       Do not backup files needed for uninstall

      */f*                        Force other programs to close when the
computer shuts down

*Note *You can combine these switches into one command. For backward
compatibility, the security update also supports the setup switches that
the previous version of the setup utility uses. For more information
about the supported installation switches, see Microsoft Knowledge Base
Article about the supported installation switches, see Microsoft
Knowledge Base Article 262841
.

*Deployment Information*

To install the security update without any user intervention, use the
following command at a command prompt for Windows Server 2003:

*Windowsserver2003-kb839643-x86-enu /passive /quiet*

To install the security update without forcing the system to restart,
use the following command at a command prompt for Windows Server 2003:

*Windowsserver2003-kb839643-x86-enu /norestart*

For information about how to deploy this security update with Software
Update Services, visit the Software Update Services Web site
.

*Restart Requirement*

In some cases, this update does not require a restart. The installer
stops the required services, applies the update, and then restarts the
services. However, if the required services cannot be stopped for any
reason or if required files are in use, this update will require a
restart. If this occurs, a message appears that advises you to restart.

*Removal Information*

To remove this update, use the Add or Remove Programs tool in Control Panel.

System administrators can also use the Spuninst.exe utility to remove
this security update. The Spuninst.exe utility is located in the
%Windir%\$NTUninstallKB839643$\Spuninst folder. The Spuninst.exe utility
supports the following setup switches:

*/?*: Show the list of installation switches.

*/u*: Use unattended mode.

*/f*: Force other programs to quit when the computer shuts down.

*/z*: Do not restart when the installation is complete.

*/q*: Use Quiet mode (no user interaction).

*File Information*

The English version of this update has the file attributes (or later)
that are listed in the following table. The dates and times for these
files are listed in coordinated universal time (UTC). When you view the
file information, it is converted to local time. To find the difference
between UTC and local time, use the *Time Zone* tab in the Date and Time
tool in Control Panel.

Windows Server 2003 Enterprise Edition, Windows Server 2003 Standard
Edition, Windows Server 2003 Web Edition, and Windows Server 2003
Datacenter Edition:

   Date         Time   Version      Size       File name        Folder
   -------------------------------------------------------------------------
  05-May-2004 22:58   5.2.3790.170   8,704    Custom_uninstall.dll 
  07-May-2004 20:08   5.2.3790.163  221,184   Dplayx.dll         RTMGDR
  07-May-2004 20:08   5.2.3790.163  55,296    Dpwsockx.dll       RTMGDR
  07-May-2004 20:09   5.2.3790.163  221,184   Dplayx.dll         RTMQFE
  07-May-2004 20:09   5.2.3790.163  55,296    Dpwsockx.dll       RTMQFE

Windows Server 2003 64-Bit Enterprise Edition and Windows Server 2003
64-Bit Datacenter Edition:

   Date         Time   Version      Size       File name    Platform  Folder
   -------------------------------------------------------------------------
   05-May-2004  22:57  5.2.3790.170       19,456  Custom_uninstall.dll  IA64
   07-May-2004  20:08  5.2.3790.163      221,184  Wdplayx.dll           X86  RTMGDR\WOW
   07-May-2004  20:08  5.2.3790.163       55,296  Wdpwsockx.dll         X86  RTMGDR\WOW
   07-May-2004  20:09  5.2.3790.163      221,184  Wdplayx.dll           X86  RTMQFE\WOW
   07-May-2004  20:09  5.2.3790.163       55,296  Wdpwsockx.dll         X86  RTMQFE\WOW

*Note *When you install this security update on Windows Server 2003 or
on Windows XP 64-Bit Edition Version 2003, the installer checks to see
if any of the files that are being updated on your system have
previously been updated by a Microsoft hotfix. If you have previously
installed a hotfix to update one of these files, the installer copies
the RTMQFE files to your system. Otherwise, the installer copies the
RTMGDR files to your system. For more information, see Microsoft
Knowledge Base Article 824994
.

*Verifying Update Installation *

You may also be able to verify the files that this security update has
installed by reviewing the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server
2003\SP1\KB839643\Filelist

*Note *This registry key may not contain a complete list of installed
files. Also, this registry key may not be created correctly if an
administrator or an OEM integrates or slipstreams the 839643

security update into the Windows installation source files.

Top of section Top of section






        Windows XP (all versions)
        



*Note *For Windows XP 64-Bit Edition Version 2003, this security update
is the same as the Windows Server 2003 64-Bit Edition security update.

*Prerequisites*
This security update requires the release version of Windows XP or
Windows XP Service Pack 1 (SP1). For more information, see Microsoft
Knowledge Base Article 322389
.

*Inclusion in Future Service Packs:*
The update for this issue will be included in Windows XP Service Pack 2.

*Installation Information*

This security update supports the following setup switches:

      */help                 *Displays the command line options

*Setup Modes*

      */quiet  *            *  *Quiet mode (no user interaction or display)

      */passive*            Unattended mode (progress bar only)

*      /uninstall*          Uninstalls the package

*Restart Options *

      */norestart*          Do not restart when installation is complete

      */forcerestart*      Restart after installation

*Special Options *

      */l*                        Lists installed Windows hotfixes or
update packages

      */o*                       Overwrite OEM files without prompting

      */n*                       Do not backup files needed for uninstall

      */f*                        Force other programs to close when the
computer shuts down

*Note *You can combine these switches into one command. For backward
compatibility, the security update also supports the setup switches that
the previous version of the setup utility uses. For more information
about the supported installation switches, see Microsoft Knowledge Base
Article 262841
.

*Deployment Information*

To install the security update without any user intervention, use the
following command at a command prompt for Windows XP:

*Windowsxp-kb839643-x86-enu /passive /quiet*

To install the security update without forcing the system to restart,
use the following command at a command prompt for Windows XP:

*Windowsxp-kb839643-x86-enu /norestart*

For more information about how to deploy this security update with
Software Update Services, visit the Software Update Services Web site
.

*Restart Requirement*

In some cases, this update does not require a restart. The installer
stops the required services, applies the update, and then restarts the
services. However, if the required services cannot be stopped for any
reason or if required files are in use, this update will require a
restart. If this occurs, a message appears that advises you to restart.

*Removal Information*

To remove this security update, use the Add or Remove Programs tool in
Control Panel.

System administrators can also use the Spuninst.exe utility to remove
this security update. The Spuninst.exe is located in the
%Windir%\$NTUninstallKB839643$\Spuninst folder. The Spuninst.exe utility
supports the following setup switches:

*/?*: Show the list of installation switches.

*/u*: Use unattended mode.

*/f*: Force other programs to quit when the computer shuts down.

*/z*: Do not restart when the installation is complete.

*/q*: Use Quiet mode (no user interaction).

*File Information*

The English version of this update has the file attributes (or later)
that are listed in the following table. The dates and times for these
files are listed in coordinated universal time (UTC). When you view the
file information, it is converted to local time. To find the difference
between UTC and local time, use the *Time Zone* tab in the Date and Time
tool in Control Panel.

Windows XP Home Edition, Windows XP Professional, Windows XP Home
Edition Service Pack 1, Windows XP Professional Service Pack 1, Windows
XP Tablet PC Edition, and Windows XP Media Center Edition:

   Date         Time   Version        Size       File name            Folder
   -----------------------------------------------------------------------------
   05-May-2004 23:10  5.1.2600.149  8,192  Custom_uninstall.dll      SP1
   12-May-2004  20:27  5.1.2600.148   214,528  Dplayx.dll             SP1
   12-May-2004  20:27  5.1.2600.148   50,176  Dpwsockx.dll            SP1
   05-May-2004  23:03  5.1.2600.1525  8,192  Custom_uninstall.dll     SP2
   12-May-2004  22:29  5.1.2600.1517  214,528  Dplayx.dll             SP2
   12-May-2004  22:29  5.1.2600.1517  50,176  Dpwsockx.dll            SP2

Windows XP 64-Bit Edition Service Pack 1:

   Date         Time   Version        Size       File name         Platform
   --------------------------------------------------------------------------
   05-May-2004  23:03  5.1.2600.1524   18,944  Custom_uninstall.dll  IA64
   06-May-2004  21:13  5.1.2600.1517   214,528  Wdplayx.dll          X86
   06-May-2004  21:13  5.1.2600.1517   50,176  Wdpwsockx.dll         X86

Windows XP 64-Bit Edition Version 2003:

   Date         Time   Version      Size       File name    Platform  Folder
   -------------------------------------------------------------------------
   05-May-2004  22:57  5.2.3790.170       19,456  Custom_uninstall.dll  IA64
   07-May-2004  20:08  5.2.3790.163      221,184  Wdplayx.dll           X86       RTMGDR\WOW
   07-May-2004  20:08  5.2.3790.163       55,296  Wdpwsockx.dll         X86       RTMGDR\WOW
   07-May-2004  20:09  5.2.3790.163      221,184  Wdplayx.dll           X86       RTMQFE\WOW
   07-May-2004  20:09  5.2.3790.163       55,296  Wdpwsockx.dll         X86       RTMQFE\WOW

*Notes *The Windows XP and Windows XP 64-Bit Edition Version 2003
versions of this security update are packaged as dual-mode packages,
which contain files for both the original version of Windows XP and
Windows XP Service Pack 1 (SP1). For more information about dual-mode
packages, see Microsoft Knowledge Base Article 328848
.

When you install the Windows XP 64-Bit Edition Version 2003 security
update, the installer checks to see if any of the files that are being
updated on your system have previously been updated by a Microsoft
hotfix. If you have previously installed a hotfix to update one of these
files, the installer copies the RTMQFE files to your system. Otherwise,
the installer copies the RTMGDR files to your system. For more
information, see Microsoft Knowledge Base Article 824994
.

*Verifying Update Installation *

You may also be able to verify the files that this security update has
installed by reviewing the following registry keys:

For Windows XP Home Edition, Windows XP Professional, Windows XP Home
Edition Service Pack 1, Windows XP Professional Service Pack 1, Windows
XP 64-Bit Edition Service Pack 1, Windows XP Tablet PC Edition, and
Windows XP Media Center Edition:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows
XP\SP2\KB839643\Filelist

For Windows XP 64-Bit Edition Version 2003:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server
2003\SP1\KB839643\Filelist

*Note *These registry keys may not contain a complete list of installed
files. Also, these registry keys may not be created correctly if an
administrator or an OEM integrates or slipstreams the 839643 security
update into the Windows installation source files.

Top of section Top of section






        Windows 2000 (all versions)
        



*Prerequisites*
For Windows 2000, this security update requires Service Pack 2 (SP2),
Service Pack 3 (SP3), or Service Pack 4 (SP4).

The software that is listed has been tested to determine if the versions
are affected. Other versions either no longer include security update
support or may not be affected. To determine the support lifecycle for
your product and version, visit the Microsoft Support Lifecycle Web site
.

For more information about how to obtain the latest service pack, see
Microsoft Knowledge Base Article 260910
.

*Inclusion in Future Service Packs:*
The update for this issue will be included in Windows 2000 Service Pack 5.

*Installation Information*

This security update supports the following setup switches:

      */help                 *Displays the command line options

*Setup Modes*

      */quiet  *            *  *Quiet mode (no user interaction or display)

      */passive*            Unattended mode (progress bar only)

*      /uninstall*          Uninstalls the package

*Restart Options *

      */norestart*          Do not restart when installation is complete

      */forcerestart*      Restart after installation

*Special Options *

      */l*                        Lists installed Windows hotfixes or
update packages

      */o*                       Overwrite OEM files without prompting

      */n*                       Do not backup files needed for uninstall

      */f*                        Force other programs to close when the
computer shuts down

*Note *You can combine these switches into one command. For backward
compatibility, the security update also supports the setup switches that
the previous version of the setup utility uses. For more information
about the supported installation switches, see Microsoft Knowledge Base
Article 262841
.

*Deployment Information*

To install the security update without any user intervention, use the
following command at a command prompt for Windows 2000 Service Pack 2,
Windows 2000 Service Pack 3, and Windows 2000 Service Pack 4:

*Windows2000-kb839643-x86-enu /passive /quiet*

To install the security update without forcing the system to restart,
use the following command at a command prompt for Windows 2000 Service
Pack 2, Windows 2000 Service Pack 3, and Windows 2000 Service Pack 4:

*Windows2000-kb839643-x86-enu /norestart*

*Restart Requirement*

In some cases, this update does not require a restart. The installer
stops the required services, applies the update, and then restarts the
services. However, if the required services cannot be stopped for any
reason or if required files are in use, this update will require a
restart. If this occurs, a message appears that advises you to restart.

*Removal Information*

To remove this security update, use the Add or Remove Programs tool in
Control Panel.

System administrators can also use the Spuninst.exe utility to remove
this security update. The Spuninst.exe utility is located in the
%Windir%\$NTUninstallKB839643$\Spuninst folder. The Spuninst.exe utility
supports the following setup switches:

*/?*: Show the list of installation switches.

*/u*: Use unattended mode.

*/f*: Force other programs to quit when the computer shuts down.

*/z*: Do not restart when the installation is complete.

*/q*: Use Quiet mode (no user interaction).

*File Information*

The English version of this update has the file attributes (or later)
that are listed in the following table. The dates and times for these
files are listed in coordinated universal time (UTC). When you view the
file information, it is converted to local time. To find the difference
between UTC and local time, use the *Time Zone* tab in the Date and Time
tool in Control Panel.

*Note* Date, time, and filename information could change during
installation. Refer to the Verifying Update Installation section for
details on verifying an installation.

Windows 2000 Service Pack 2, Windows 2000 Service Pack 3, and Windows
2000 Service Pack 4:

   Date         Time   Version        Size     File name
   ------------------------------------------------------
   05-May-2004  23:15  5.0.2195.6927       8,464  Custom_uninstall.dll  
   06-May-2004  19:11  5.0.2195.6922     220,432  Dplayx.dll       
   06-May-2004  19:11  5.0.2195.6922      44,304  Dpwsockx.dll     

*Verifying Update Installation *

You may also be able to verify the files that this security update has
installed by reviewing the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows
2000\SP5\KB839643\Filelist

*Note *This registry key may not contain a complete list of installed
files. Also, This registry key may not be created correctly when an
administrator or an OEM integrates or slipstreams the 839643

security update into the Windows installation source files.

Top of section Top of section






        DirectX Standalone (all versions)
        



*Prerequisites*
This security update requires a released version of the affected product.

*Inclusion in Future Service Packs:*
The update for this issue will be included in DirectX 9.0c.

*Installation Information*

This security update supports the following setup switches:

      */help                 *Displays the command line options

*Setup Modes*

      */quiet  *            *  *Quiet mode (no user interaction or display)

      */passive*            Unattended mode (progress bar only)

*      /uninstall*          Uninstalls the package

*Restart Options *

      */norestart*          Do not restart when installation is complete

      */forcerestart*      Restart after installation

*Special Options *

      */l*                        Lists installed Windows hotfixes or
update packages

      */o*                       Overwrite OEM files without prompting

      */n*                       Do not backup files needed for uninstall

      */f*                        Force other programs to close when the
computer shuts down

*Note *You can combine these switches into one command. For backward
compatibility, the security update also supports the setup switches that
the previous version of the setup utility uses. For more information
about the supported installation switches, see Microsoft Knowledge Base
Article 262841
.

*Deployment Information for DirectX 8.0*

To install the security update without any user intervention, use the
following command at a command prompt for DirectX 8.0:

*DirectX80-KB839643-enu /passive /quiet*

To install the security update without forcing the system to restart,
use the following command at a command prompt for DirectX 8.0:

*DirectX80-kb839643-x86-enu /norestart*

*Deployment Information for DirectX 8.1*

To install the security update without any user intervention, use the
following command at a command prompt for DirectX 8.1:

*DirectX81-kb839643-x86-enu /passive /quiet*

To install the security update without forcing the system to restart,
use the following command at a command prompt for DirectX 8.1:

*DirectX81-kb839643-x86-enu /norestart*

*Deployment Information for DirectX 8.2*

To install the security update without any user intervention, use the
following command at a command prompt for DirectX 8.2:

*DirectX82-kb839643-x86-enu /passive /quiet*

To install the security update without forcing the system to restart,
use the following command at a command prompt for DirectX 8.2:

*DirectX82-kb839643-x86-enu /norestart*

*Deployment Information for DirectX 9.0*

To install the security update without any user intervention, use the
following command at a command prompt for DirectX 9.0:

*DirectX90-kb839643-x86-enu /passive /quiet*

To install the security update without forcing the system to restart,
use the following command at a command prompt for Windows Server
2003DirectX 9.0:

*DirectX90-kb839643-x86-enu /norestart*

*Restart Requirement*

In some cases, this update does not require a restart. The installer
stops the required services, applies the update, and then restarts the
services. However, if the required services cannot be stopped for any
reason or if required files are in use, this update will require a
restart. If this occurs, a message appears that advises you to restart.

*Removal Information*

To remove this security update, use the Add or Remove Programs tool in
Control Panel.

System administrators can also use the Spuninst.exe utility to remove
this security update. The Spuninst.exe utility is located in the
%Windir%\$NTUninstallKB839643$\Spuninst folder. The Spuninst.exe utility
supports the following setup switches:

*/?*: Show the list of installation switches.

*/u*: Use unattended mode.

*/f*: Force other programs to quit when the computer shuts down.

*/z*: Do not restart when the installation is complete.

*/q*: Use Quiet mode (no user interaction).

*File Information*

The English version of this update has the file attributes (or later)
that are listed in the following table. The dates and times for these
files are listed in coordinated universal time (UTC). When you view the
file information, it is converted to local time. To find the difference
between UTC and local time, use the *Time Zone* tab in the Date and Time
tool in Control Panel.

*Note* Date, time, and filename information could change during
installation. Refer to the Verifying Update Installation section for
details on verifying an installation.

DirectX 8.0 when installed on Windows 2000:

   Date         Time   Version      Size       File name 
  -------------------------------------------------------
   07-May-2004  17:17  5.3.1.904    9,216     Custom_uninstall.dll  
   14-Apr-2004  21:55  5.1.2258.410 233,984  Dplayx.dll       
   13-Apr-2004  06:13  5.1.2258.410  88,064  Dpwsockx.dll    

*Verifying Update Installation *

You may be able to verify the files that this security update has
installed by reviewing the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\DirectX\DX8\SP1\KB839643-DirectX8

*Note *This registry key may not be created correctly when an
administrator or an OEM integrates or slipstreams the 839643

security update into the Windows installation source files.

DirectX 8.1 when installed on Windows 2000, Windows XP or Windows Server
2003:

   Date         Time   Version      Size       File name    
   -------------------------------------------------------------
   07-May-2004  17:17  5.3.1.904     9,216  Custom_uninstall.dll  
   14-Apr-2004  21:56  5.1.2600.891  214,528  Dplayx.dll       
   13-Apr-2004  06:19  5.1.2600.891  73,216  Dpwsockx.dll

*Verifying Update Installation *

You may be able to verify the files that this security update has
installed by reviewing the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\DirectX\DX8.1\SP1\KB839643-DirectX81

*Note *This registry key may not be created correctly when an
administrator or an OEM integrates or slipstreams the 839643

security update into the Windows installation source files.

DirectX 8.2 when installed on Windows 2000, Windows XP or Windows Server
2003:

   Date         Time   Version      Size       File name    
   -------------------------------------------------------------
   07-May-2004  17:17  5.3.1.904    9,216    Custom_uninstall.dll  
   14-Apr-2004  21:57  5.2.3677.144 219,648  Dplayx.dll       
   13-Apr-2004  06:12  5.2.3677.144 76,800   Dpwsockx.dll

*Verifying Update Installation *

You may be able to verify the files that this security update has
installed by reviewing the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\DirectX\DX8.2\SP1\KB839643-DirectX82

*Note *This registry key may not be created correctly when an
administrator or an OEM integrates or slipstreams the 839643

security update into the Windows installation source files.

DirectX 9.0 when installed on Windows 2000, Windows XP or Windows Server
2003:

   Date         Time   Version      Size       File name 
  -----------------------------------------------------------------
   07-May-2004  17:17  5.3.1.904    9,216      Custom_uninstall.dll  
   14-Apr-2004  21:56  5.3.0.903    219,648    Dplayx.dll       
   13-Apr-2004  06:11  5.3.0.903    76,800     Dpwsockx.dll   

*Verifying Update Installation *

You may be able to verify the files that this security update has
installed by reviewing the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\DirectX\DX9\SP1\KB839643-DirectX9

*Note *This registry key may not be created correctly when an
administrator or an OEM integrates or slipstreams the 839643

security update into the Windows installation source files.

Top of section Top of section

Top of section Top of section


*Acknowledgments*

Microsoft thanks  the
following for working with us to help protect customers:

?

John Lampe Tenable Network Security  for
reporting the vulnerability (CAN-2004-0202).

*Obtaining Other Security Updates:*

Updates for other security issues are available from the following
locations:

?

Security updates are available from the Microsoft Download Center
: You can find them most
easily by doing a keyword search for "security_patch".

?

Updates for consumer platforms are available from the Windows Update Web
site .

*Support: *

?

Customers in the U.S. and Canada can receive technical support from
Microsoft Product Support Services
 at 1-866-PCSAFETY. There
is no charge for support calls that are associated with security updates.

?

International customers can receive support from their local Microsoft
subsidiaries. There is no charge for support that is associated with
security updates. For more information about how to contact Microsoft
for support issues, visit the International Support Web site
.

*Security Resources: *

?

The Microsoft TechNet Security
 Web Site provides
additional information about security in Microsoft products.

?

Microsoft Software Update Services


?

Microsoft Baseline Security Analyzer
 (MBSA)

?

Windows Update  

?

Windows Update Catalog: For more information about the Windows Update
Catalog, see Microsoft Knowledge Base Article 323166
.

?

Office Update  

*Software Update Services:*

By using Microsoft Software Update Services (SUS), administrators can
quickly and reliably deploy the latest critical updates and security
updates to Windows 2000 and Windows Server 2003-based servers, and to
desktop systems that are running Windows 2000 Professional or Windows XP
Professional.

For more information about how to deploy this security update with
Software Update Services, visit the Software Update Services Web site
.

*Systems Management Server:*

Microsoft Systems Management Server (SMS) delivers a highly-configurable
enterprise solution for managing updates. By using SMS, administrators
can identify Windows-based systems that require security updates and to
perform controlled deployment of these updates throughout the enterprise
with minimal disruption to end users. For more information about how
administrators can use SMS 2003 to deploy security updates, see the SMS
2003 Security Patch Management Web site
. SMS 2.0 users can also
use Software Updates Service Feature Pack
 to help deploy security
updates. For information about SMS, visit the SMS Web site
.

*Note *SMS uses the Microsoft Baseline Security Analyzer and the
Microsoft Office Detection Tool to provide broad support for security
bulletin update detection and deployment. Some software updates may not
be detected by these tools. Administrators can use the inventory
capabilities of the SMS in these cases to target updates to specific
systems. For more information about this procedure, see the following
Web site . Some
security updates require administrative rights following a restart of
the system. Administrators can use the Elevated Rights Deployment Tool
(available in the *SMS 2003 Administration Feature Pack*
 and in the *SMS 2.0
Administration Feature Pack*
) to install these updates.

*Disclaimer: *

The information provided in the Microsoft Knowledge Base is provided "as
is" without warranty of any kind. Microsoft disclaims all warranties,
either express or implied, including the warranties of merchantability
and fitness for a particular purpose. In no event shall Microsoft
Corporation or its suppliers be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business
profits or special damages, even if Microsoft Corporation or its
suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not
apply.

*Revisions:* 

?

V1.0 (June 8, 2004): Bulletin published