Microsoft has released security bulletin MS08-040. To view the complete security bulletin, visit one of the following Microsoft Web sites:

• Home users:
  http://www.microsoft.com/protect/computer/updates/bulletins/200807.mspx (http://www.microsoft.com/protect/computer/updates/bulletins/200807.mspx)
  Skip the details: Download the updates for your home computer or for your laptop from the Microsoft Update Web site now:
  http://update.microsoft.com/microsoftupdate/ (http://update.microsoft.com/microsoftupdate/)
• IT professionals:
  http://www.microsoft.com/technet/security/bulletin/MS08-040.mspx (http://www.microsoft.com/technet/security/bulletin/MS08-040.mspx)

How to obtain help and support for this security update

For home users, no-charge support is available by calling 1-866-PCSAFETY in the United States and Canada or by contacting your local Microsoft subsidiary. For more information about how to contact your local Microsoft subsidiary for support issues with security updates, visit the Microsoft International Support Web site: North American customers can also obtain instant access to unlimited no-charge e-mail support or to unlimited individual chat support by visiting the following Microsoft Web site: For enterprise customers, support for security updates is available through your usual support contacts.

Known issues with this security update

• If the WMSDE database is larger than 2 gigabytes (GB), you must perform the following step to successfully update WMSDE with this security update:
  • For supported 32-bit editions of the WSS (SharePoint) instances of SQL Server 2000 Desktop Engine (WMSDE), follow these steps:
    1. Download this security update by using one of the links in the "Introduction" section.
    2. Install this security update.
    3. Click Start, click Run, type cmd in the Open box, and then click OK.
    4. At the command prompt, type the following command and then press ENTER:
       SQLWMSDE-KB948110-x86-ENU /quiet /upgradesp sqlrun DISABLENETWORKPROTOCOLS=1 DISABLEAGENTSTARTUP=1 DISABLETHROTTLE=1 BLANKSAPWD=1 INSTANCENAME=Sharepoint REINSTALL=ALL REINSTALLMODE=VEMUS /l*v %windir%WMSDE.log
  • For supported 32-bit editions of the WSUS instances of SQL Server 2000 Desktop Engine (WMSDE), follow these steps:
    1. Download this security update by using one of the links in the "Introduction" section.
    2. Install this security update.
    3. Click Start, click Run, type cmd in the Open box, and then click OK.
    4. At the command prompt, type the following command and then press ENTER:
       SQLWMSDE-KB948110-x86-ENU /quiet /upgradesp sqlrun DISABLENETWORKPROTOCOLS=1 DISABLEAGENTSTARTUP=1 DISABLETHROTTLE=1 BLANKSAPWD=1 INSTANCENAME=WSUS REINSTALL=ALL REINSTALLMODE=VEMUS /l*v %windir%WMSDE.log
• When you use the Add or Remove Programs item in Control Panel to uninstall this security update, the SQL Server 2000 Desktop Engine (WMSDE) is also removed.
• SharePoint users who upgraded from SQL Server 2000 Desktop Engine (WMSDE) to any other edition of SQL Server 2000 (for example, SQL Server 2000 Standard Edition) may be incorrectly offered a WMSDE update for this security release. This problem can occur if the SQL Server 2000 edition is not patched correctly with SQL Server 2000 Service Pack 4 after the upgrade from WMSDE. The WMSDE update may cause SharePoint to stop working. To resolve this problem if this occurs, follow these steps to restore SharePoint functionality:
  1. Perform the upgrade to SQL Server 2000 again.
     
     Note You must use the same media that was previously used to perform the upgrade to SQL Server 2000.
  2. Restart the server instance. The server instance should start as the upgraded version.
  3. Apply SQL Server 2000 Service Pack 4.
     
     Note Make sure that you apply the SQL Server 2000 Service Pack 4 and not the MSDE SP4 or WMSDE SP4 updates.
     
     For more information about how to obtain SQL Server 2000 Service Pack 4, visit the following Microsoft Web page:
     http://www.microsoft.com/downloads/details.aspx?FamilyID=8e2dfc8d-c20e-4446-99a9-b7f0213f8bc5&displaylang=en (http://www.microsoft.com/downloads/details.aspx?FamilyID=8e2dfc8d-c20e-4446-99a9-b7f0213f8bc5&displaylang=en)
  4. Manually apply sp4_serv_uni.sql from the Install folder. To do this, type the following command at a command prompt:
     osql -n -b -d master -Slpc:%computername%\SHAREPOINT -i "%programfiles%\Microsoft SQL Server\MSSQL$SHAREPOINT\Install\sp4_serv_uni.sql" -o "%programfiles%\Microsoft SQL Server\MSSQL$SHAREPOINT\Install\sp4_serv_uni.out" -E
     
     
     Note These steps assume that the WMSDE installation folder is in the default location. If you are using a custom installation, you must adjust the path accordingly in the command.
• Microsoft Internet Security and Acceleration (ISA) Server 2004 and ISA Server 2006 could be affected by this update in the following ways:
  • The MSSQL$MSFW service is stopped and then restarted when the associated database instances are updated. This action occurs if Microsoft SQL Server 2000 or Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) is installed on the computer that is running ISA Server. This action also stops the Microsoft Firewall service. Therefore, the SQL Server installer tries to return the Microsoft Firewall service to the same state that it was in before the update was started. Because the update installer cannot control services on a remote server, you must monitor and possibly restart the Microsoft Firewall service and the dependent services if ISA Server is configured for remote SQL Server logging.
    
    By default, ISA Server disables remote network connectivity for the ISA Server MSDE instance (MSSQL$MSFW) to prevent vulnerability to network-based SQL attacks. ISA Server 2004 Setup installs a pre-SQL Server 2000 Service Pack 4 (SP4) version of MSDE 2000 that you must upgrade to SQL Server 2000 SP4 before you apply this update. For more information about how to obtain SQL Server 2000 SP4, visit the following Microsoft Web site:
    http://www.microsoft.com/downloads/details.aspx?FamilyID=8e2dfc8d-c20e-4446-99a9-b7f0213f8bc5 (http://www.microsoft.com/downloads/details.aspx?FamilyID=8e2dfc8d-c20e-4446-99a9-b7f0213f8bc5)
    The MSDE 2000 component of SQL Server 2000 SP4 is named the SQL2000.MSDE-KB884525-SP4-x86-Lang.exe file. Type the following command at a command prompt to upgrade the instance of ISA Server 2004 MSDE to MSDE 2000 together with SQL Server 2000 SP4:
    setup /upgradesp sqlrun instancename=MSFW /l*v c:\msde2Ksp4.log
    Important The SQL Server 2000 SP4 installer also stops and then tries to restart the Microsoft Firewall service. However, the service may not correctly restart after you install the security update. In this case, you may have to restart the service manually.
  • ISA Server 2006 installs MSDE 2000 together with SQL Server 2000 SP4.
    
    By default, ISA Server 2000 is not affected by the SQL Server security update. ISA Server 2000 may be configured to use a remote instance of SQL Server for logging. If that instance of SQL Server is updated, ISA Server 2000 may be affected in the same manner as ISA Server 2004 and ISA Server 2006. Because the update installer cannot control services on a remote server, you must monitor and possibly restart the ISA Server services.

File information

The English (United States) version of this security update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

For all supported 32-bit editions of SQL Server 2000 SP4

For all supported Itanium-based editions of SQL Server 2000 SP4

For all supported editions of SQL Server 2000 Desktop Engine (WMSDE)