« Rock Music: Iron Maiden and Bjork | Main | playthings »

August 31, 2003

Geektip: MS Security Update 819696 and your daily routine

comments (0)
filed under:

No, it’s not just you.

Every morning I get up, shower, brush my teeth, eat some children’s cereal, download and install Microsoft Security Update #819696, and head off to work. Recently, I decided this was too many steps and that I should trim down my morning routine. The teeth thing seemed important and I’ve been known to skip the shower anyways… that pretty much left the Golden Grahams or the MS Update and I think we know who’s gonna win out there.

I did a little bit of snooping and found that other people are having the same difficulty installing. Downloading and installing the patch and then being told that they didn’t. Are they still in jeopardy of losing their information to a mean-spirited thirteen year old’s code? What exactly could happen if it’s not installed?

What it means

Microsoft Security Bulletin (#MS03-030) is entitled “Unchecked Buffer in DirectX Could Enable System Compromise” and is rated Critical. Microsoft Security Update 819696 is a DirectX patch that is meant to prevent malicious code from being executed by way of an unchecked buffer as a DirectX app on your machine. What that all really means is this: DirectX is really nothing more than a series of instructions for your machine on how to process different bit of information. It contains hundred of different sets of instructions and API’s (application programming interfaces) which run on your machine, making sense of the one and zeros. One component of DX is called DirectShow. This item controls client-side audio and video rendering. Part of that function would be controlling MIDI. As Microsoft puts it:

There are two buffer overruns with identical effects in the function used by DirectShow to check parameters in a Musical Instrument Digital Interface (MIDI) file. A security vulnerability results because it could be possible for a malicious user to attempt to exploit these flaws and execute code in the security context of the logged-on user. An attacker could seek to exploit this vulnerability by creating a specially crafted MIDI file designed to exploit this vulnerability and then host it on a Web site or on a network share, or send it by using an HTML-based e-mail. […] If the file was embedded in a page the vulnerability could be exploited when a user visited the Web page. In the HTML-based e-mail case, the vulnerability could be exploited when a user opened or previewed the HTML-based e-mail. […] A successful attack could cause an attacker’s code to run on the user’s computer in the security context of the user.
What to do

“Geez! I’d better make sure I get that patch!”
Turns out that if it’s installed, it’s installed. You did it and it was successful? Good. You don’t need to do it again, no matter what MS Update tells you. Not sure if you did it? Get it here. It seems that since this patch becomes part of the DirectX API set, instead of being catalogued as a separate Hotfix or app, the Microsoft Update site sometimes has trouble determining whether or not your machine has already installed it. Yeah, sometimes MS Update sucks a little.
The only solution I’ve found is to upgrade to the newest version of DirectX9.0b. That way, MS Update won’t be able to miss the fact that your DirectX package is complete. You’ll notice that DX9b is not mentioned on the MS Patch entry page as an affected program. Get it, and MS will know your DX is not in danger.

To check which version of DirectX you’re currently running, open your RUN dialog in your START menu and type “dxdiag”.

Microsoft Security Update MS03-030 (819696)
DirectX 9.0b End-user Runtime