Ms09-035

(imported topic written by capricorn8091)

Hi!

I am having problem with one of the patch given below.

Microsoft Visual Studio 2005 Service Pack 1 64-bit Hosted Visual C++ Tools

Its missing on the window 7 machine and when i am trying to install it i get message

“The upgrade patch cannot be installed by the windows installer service because the program to be upgraded may be missing, or the upgrade patch may update a different version of the program.” Verfity that the program to be upgraded exists on your computer and that you have the correct upgrade patch."

I tried lot of options but nothing worked. Now i tried with fixlet debugger and I am getting all this:

exists key “HKEY_CLASSES_ROOT\Installer\Products” of (registry; x64 registry)) AND (exists key whose (((it contains “Visual Studio 2005” AND (it contains “Professional Edition” OR it contains “Team Suite” OR (it contains “Team Edition” AND (it contains “Developers” OR it contains “Architects” OR it contains “Testers”)))) of (value “ProductName” of it as string)) and (value “Language” of it as string = “1033”)) of key “HKEY_CLASSES_ROOT\Installer\Products” of registry) AND exists key whose (exists key “KB926601” of it AND name of it as string starts with “Microsoft Visual Studio 2005”) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates” of registry AND exists file “msiexec.exe” whose (version of it >= “3.1”) of system folder AND NOT exists key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Microsoft Visual Studio 2005 Professional Edition - ENU\KB973830” whose (value “Installed” of it = 1) of registry AND not exists keys whose (value “DisplayName” of it as string contains “KB973830”) of keys “Patches” of keys of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products” of native registry AND (exists key “HKLM\SOFTWARE\Microsoft\VisualStudio\8.0\VC\VC_OBJECTS_PLATFORM_INFO\Win64 (AMD64)” of it AND exists key “HKLM\SOFTWARE\Microsoft\VisualStudio\8.0\VC\VC_OBJECTS_PLATFORM_INFO\Win64 (Itanium)” of it) of registry

I dont know how to proceed with this output as i cant find “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Microsoft Visual Studio 2005 Professional Edition - ENU\KB973830” in the registry.

Can anyone help me how i can proceed in this program.

Many Thanks.

(imported comment written by SystemAdmin)

Can you be more specific? Are you applying this patch through the console or are you installing it manually? Is your msiexec.exe at version 3.1 or greater? Are you sure this patch is relevant for your machine?

Also, you won’t find “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Microsoft Visual Studio 2005 Professional Edition - ENU\KB973830” in the registry because this key only shows up after an installation of the patch.

(imported comment written by capricorn8091)

Hi!

I am applying the patch manually. I will check the version of msiexec but hopefully it should be latest one as i am running window 7. Well talking about relevant stuff … Bigfix is reporting that its relevant to the machine and its missing patch and i you can also see that Fixlet debugger is reporting also reporting it. sorry i forget to paste the first line. Here it is.

MS09-035: Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution - Visual Studio 2005 SP1 64-bit Hosted Visual C++ Tools

(imported comment written by SystemAdmin)

I just took a look closer look at the Fixlet in question and noticed something in the Fixlet description. Have you checked the description of this Fixlet in the console? From what I’m seeing, this patch only applies to Itanium machines, and there’s a chance that the console will report false positives for this particular Fixlet. Because this patch only applies to Itanium machines, which are for Windows Server 2003 and 2008, this means that it should fail for Windows 7.

(imported comment written by capricorn8091)

Hi!

I am newbie with this fixlet. Please can you explain more about this fixlet description?

Thanks

(imported comment written by SystemAdmin)

In the console, when you select a Fixlet, the Work Area (section that is right underneath the section that lists all the Fixlets) will change. There will be several buttons and tabs for the Fixlet. One of the tabs will be labeled “Description”. Select that tab, and it will display information about the Fixlet.

For that particular Fixlet, this is what’s written in the description:

Important Note: The patch that Microsoft published for the Visual Studio 64-bit Hosted Visual C++ Tools 2005 Service Pack 1 ATL Security Update vulnerability described in MS09-035 (VS80sp1-KB973830-IA64-INTL.exe) applies to Itanium (IA64) machines only. As BigFix does not support the Itanium architecture, we will not be releasing Fixlet content for this update at this time.

Important Note: The relevance in this audit only fixlet may detect false positives due to incomplete information from Microsoft at this time.

(imported comment written by capricorn8091)

ok. Is there any way i can get rid of this. I mean bigfix will stop reporting this as missing patch because i tried alot of stuff and still i cant make it working and its keep reporting as missing patch by bigfix.

thanks for above information.

(imported comment written by SystemAdmin)

In the same area, there should be a button that says “Hide Locally” and “Hide Globally”. Selecting either one of them will hide it from your view.

(imported comment written by capricorn8091)

Ok. Thanks for your information and help.

(imported comment written by SystemAdmin)

Hi,

I’m not sure how many of you are still having an issue with this particular Fixlet, but we have recently made a change to it. There is now a new action in this Fixlet that the user can execute. What it does is it makes this Fixlet no longer relevant by setting a specific registry key. This change can be seen in site version 1555.

For those of you who are seeing this Fixlet but cannot do anything about it except hide it in the console, hopefully this change will help “solve” this problem.