ALARM Group ALERT - click for a description of ALARM, The Computing Alert System Alert Number:  040407-01 Alert Date:  04/04/07 Alert Title:  Microsoft security update may cause error messages or other problems Update-to:   033007-02 "UAlbany blocking .ani file extensions" 033007-01 "Microsoft Animated Cursor vulnerability" 040307-01 "New Vulnerability in Windows Animated Cursor Handling Could Allow Remote Code Execution" OS/Platform/Application:   Microsoft Windows XP (including Service Pack 2, 64-Bit and Itanium-based systems) Category:  UPDATE Severity:  N/A Attention:  System Administrators, Desktop Support Personnel, Microsoft Windows users

Summary:  Microsoft released security update 925902 on April 3 2007 ahead of its standard schedule (2nd Tuesday per month) to address a vulnerability in the way Windows handles .ani files.  Since the release of update 925902 some users are reporting the presence of error messages on system startup and other problems such as the inability to start certain programs.  At the time of this writing the only confirmed issue pertains to Windows XP systems that are running the Realtek HD Audio Control Panel. An example of the error message associated with some instances of
this problem is presented below:

Rthdcpl.exe - Illegal System DLL Relocation

The system DLL user32.dll was relocated in memory. The application will not run properly. The relocation occurred because the DLL C:\Windows\System32\Hhctrl.ocx occupied an address range reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL.

It is possible that other applications, etc may be reported to Microsoft as having problems in the near future as well.  Microsoft is currently asking users to report any new problems to their Product Support Services.

Recommended Actions:  Microsoft has released a knowledge base article that addresses the Realtek HD Audio Control issue.  Windows system administrators, helpdesk personnel, and home/UA users That experience application/stability problems with this application/see the error message printed below are advised to refer to the article for further info and/or download the hotfix supplied by Microsoft that fixes this problem.  Users are also encouraged to contact Microsoft Product Support Services (1-866-PCSAFETY) if they experience any other stability/performance etc issues following the installation of security update 925902.

ITS Actions: N/A (this is an update).


Resources:

Microsoft Knowledge Base Article 935448:
http://support.microsoft.com/kb/935448/

SANS Diary entry on issues pertaining to security update 925902:
http://isc.sans.org/diary.html?storyid=2565