MS03-011 Bulletin

[Jeff Lloyd]

My computer (XP-Pro SP2) keeps wanting to install an upgrade to Microsoft VM
below but when it trys to install, I get a message saying the patch will
only install over an existing installation of VM. The OS is trying to
install a patch to something I don't even have installed. Do I need this to
be installed?

Any comments or direction greatly appreciated.
---------------------------


Microsoft Security Bulletin MS03-011
Flaw in Microsoft VM Could Enable System Compromise (816093)

Originally posted: April 09, 2003
Updated: April 13, 2003

Summary
Who should read this bulletin:
Customers using Microsoft® Windows®.

Impact of vulnerability:
Allow attacker to execute code of his or her choice.

Maximum Severity Rating:
Critical

Recommendation:
Customers should install build 3810 or later of the Microsoft VM, as
discussed below

 

[VanguardLH]

in message

My computer (XP-Pro SP2) keeps wanting to install an upgrade to
Microsoft VM below but when it trys to install, I get a message
saying the patch will only install over an existing installation of
VM. The OS is trying to install a patch to something I don't even
have installed. Do I need this to be installed?

You shouldn't be using the antiquated Java VM that was supplied by
Microsoft. By now, you should've installed the Java VM from Sun (who
forced Microsoft to quit distributing their VM).

http://java.com/java/download/index.jsp

 

[Jeff Lloyd]

in message



You shouldn't be using the antiquated Java VM that was supplied by
Microsoft. By now, you should've installed the Java VM from Sun (who
forced Microsoft to quit distributing their VM).

http://java.com/java/download/index.jsp

I thought I had read that somewhere -- I have had Java installed for years
now, but this update only started showing up on Windows update (for me) so
that's why I was confused. I just hid the update and forgot about it.
Thanks for the tip.

 

[VanguardLH]

in message

...

I thought I had read that somewhere -- I have had Java installed for
years now, but this update only started showing up on Windows update
(for me) so that's why I was confused. I just hid the update and
forgot about it. Thanks for the tip.

Some products will install a "newer" version of Microsoft's VM;
however, since it is actually an later but still antiquated version,
that might've been why Windows Update triggered on it figuring that
you have an old version installed and a newer version was available.
For example, if you install the older VisualStudio v6, it installs a
version of msjava that is older than the version included in the
Windows install (and there is probably a WU patch to that "newer"
version and why it told you about it). I wouldn't bother with it and
would do as you did: check the box to hide that "update".