No Word About SP3; Network Printer Bug; and WMP Security Rollup

Microsoft Misses SP3 Deadline
I heard through the grapevine that Microsoft was testing a beta version of Windows 2000 Service Pack 3 (SP3) a few weeks back. As of today, the company has missed the last official SP3 release-date target with no news about when the pending behemoth will actually hit the streets. The only conclusion I can draw is that SP3's size and complexity has tied even Microsoft's testing team in knots. The missed deadline doesn't bode well for those of us who are looking to SP3 to replace the 200 to 500 individual OS patches we're managing today. Are any of you testing the beta version? If so, please feel free to share your experiences and help us set our expectations properly.

RPC Bug Makes Network Printers Unavailable
Do your users have trouble browsing for or printing to network printers? If so, here's a potential solution for the problem. A recent posting indicates that the spooler service on Windows 2000 print servers that use a low-speed link (e.g., dialup modem or slow VPN connection) to provide print resources can run out of remote procedure calls (RPC) threads. Without free RPC threads, the server can't return the print browse list to clients and the spooler can't create the temporary file it needs to queue the print job. If this bug is causing the problem, you'll see these three symptoms: When a client attempts to browse the print list on a server, the request times out without displaying any printers; requests to print to one of the printers on the server fail; and you can submit and successfully print jobs if you log on to the print server locally.

You can confirm this problem by running Network Monitor and trapping the packets the client exchanges with the print server. Network Monitor will report a status of STATUS_IO_TIMEOUT in response to the client's Server Message Block (SMB) print request and STATUS_PIPE_NOT_AVAILABLE in response to the CreateFile call to the server. To restore print server functionality, call Microsoft Product Support Services (PSS) and ask for the print server bug fix that contains updates to three files: Ole32.dll, Rpcrt4.dll, and Rpcss.dll. All three files have a release date of June 13. For more information, read the article "Cannot Browse Printers When You Are Trying to Print or Browse Printer Queues" at;en-us;q322953.

Windows Media Player Security Rollup
If you haven't recently updated Windows Media Player (WMP) on Windows XP or Windows 2000, you can bring the buggy media player current by installing the WMP rollup Microsoft released last week. The rollup is available for WMP 6.4 on Win2K, Windows NT, and Windows 9x, for WMP 7.1 on Win2k, and for WMP 8 and later on Windows XP. The combined update contains all previously published hotfixes plus three new code changes that eliminate opportunities a malicious user can exploit to run programs or scripts with elevated privileges. Two of the vulnerabilities —the cache information disclosure and media device manager service (MDMS)—affect all three versions of WMP; the Active Playlist scripting vulnerability applies only to WMP on XP. The rollup has a critical severity rating on client systems because the vulnerabilities permit a user to run code or scripts with potentially unrestricted privileges.

You must download the rollup that matches the WMP version you're running, so check the version before you click the links below. All three rollups use a GUI-based media installer called the Windows Component Media Setup Utility, which guides you through the installation procedure. You can also run the setup_wm.exe installer from the command line with any combination of the following options:

  • /q - Specifies quiet mode (no user intervention)
  • /q:u - Specifies user-quiet mode, which presents some dialog boxes to the user
  • /q:a - Specifies administrator-quiet mode, which doesn't present dialog boxes to the user.
  • /t: full path - Specifies the temporary working folder.
  • /c - Extracts the files without running Setup when used with /t
  • /c: Cmd - Override the install command that the author defined
  • /r:n - Never restarts the computer after installation.
  • /r:i - Restarts the computer if it's necessary to complete installation
  • /r:a - Always restarts the computer after installation
  • /r:s - Restarts the computer after installation without prompting the user

So, for example, to extract the rollup files, but not install them, type the command

setup_wm.exe /t:c:\temp /c

which places the rollup files, including the setup_wm.exe installer, in the c:\temp directory. You must reboot to complete the installation to force the OS to replace the old WMP files with those in the rollup.

In addition to closing security loopholes, the rollup also removes the standard file association between Windows Media Skin (.wms) files and the WMP program. After you reboot, the media player will no longer start automatically when you double-click a .wms file. If you make heavy use of such files, you can use Windows Explorer to manually recreate the file association. Microsoft Security Bulletin MS02-032 (26 June 2002 Cumulative Patch for Windows Media Player) at contains a detailed explanation of how a malicious user can exploit the latest round of vulnerabilities. For additional information, see the Microsoft article "MS02-032: Windows Media Player Rollup Available" at;en-us;q320920.

The XP rollup contains three files—msdsm.ocx, wmpcore.dll, and wmplayer.exe—and is available for download at

The Win2K rollup for WMP 7.1 updates five WMP files—msdxm.ocx, msdxm550.ocx, mspmspsv.exe, mmpcore.dll, and wmplayer.exe—and is available for download at

The rollup for WMP 6.4 contains two versions of msdsm.ocx, one for Win2K and NT and one for Win9x, and is available for download at

TAGS: Security
Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.