Updating Windows XP Embedded runtimes with QFE

[Tony]

Lynda,

Thank you for your prompt response and for providing
the "Updating Windows XP Embedded runtimes with QFE" doc.

Am I correct in assuming then that the security patches
written for XP professional are not intended for (and
therefore not supported on) XPE, and that updating an XPE
runtime requires the QFE patches and either 1) using DUA
support which must be already included in the runtime
image or 2) extracting the needed files and registry
entries from the QFE patch and copying them to the runtime
image?

Are there documents similar to "Updating Windows XP
Embedded runtimes with QFE" that apply to updates other
than Security Bulletin MS03-026? Will there be?

Thank you,
--Tony Brown

 

[Tony]

Lynda,

Will text files giving info about registry keys and files
that changed for previous QFE's be made available?

I am specifically interested in info for the QFE's related
to the following security bulletins:
MS03-010, MS03-014, MS03-023
(I have already downloaded the related QFE update files
for these from Microsoft)

Also, I am also interested in obtaining QFE's and the
change info for the following bulletins:
MS03-024, MS03-015, MS03-018, MS03-020, MS03-027, MS03-071
(I have not been able to identify the related QFE update
files for these on the Microsoft download site)

Do you have any information on when these
update/information files will be available? We would like
to be a bit more proactive in defending against possible
future virus attacks.

Thank you,
Tony Brown

 

[Jon Fincher (MS)]

Lynda,

Will text files giving info about registry keys and files
that changed for previous QFE's be made available?

Since I'm the guy who does the QFE's for XPE, I'll jump in here.

We're working on that - we need to find a way to get that info out without
having to rerelease the QFE itself.

I am specifically interested in info for the QFE's related
to the following security bulletins:
MS03-010, MS03-014, MS03-023
(I have already downloaded the related QFE update files
for these from Microsoft)

I can collate and make that info available on the newsgroup. Give me a
few days to get everything together. Note that for some QFE's, simple
file and registry information won't cut it - there may be other processes
that need to occur (IIS QFE's are famous for this). We haven't made a
call on how to handle those on a live image, so for now, if the QFE can't
be expressed as simple file and registry changes, there won't be any extra
information given. I'd rather not give out an incomplete solution.

Also, I am also interested in obtaining QFE's and the
change info for the following bulletins:
MS03-024, MS03-015, MS03-018, MS03-020, MS03-027, MS03-071
(I have not been able to identify the related QFE update
files for these on the Microsoft download site)

MS03-017, MS03-020, MS03-024, and MS03-027 are all in line to be authored
as XPE QFE's. They've necessarily taken a backseat lately to the
MS02-026.

MS03-015 and MS03-018 are superceded by MS03-020 (all are Internet
Explorer QFEs), and has been recently superceded by MS03-032. Since all
QFE's to a given technology (or even a given file) are cumulative, the
latest IE patch will contain all the previous fixes as well. The plan is
to go with the latest rollup package we have, but if there's a compelling
need for the earlier QFE's as well, we can release those as well.

Do you have any information on when these
update/information files will be available? We would like
to be a bit more proactive in defending against possible
future virus attacks.

I had a schedule set that would have had everything caught up
by now, but recent events have driven everything awry. We do try to keep
within a 90 day window after the desktop security bulletin is released. I
do process the QFE's in release order, with exceptions due to emergencies
(MS03-026 for example), so the next QFE unrelated to the RPC issue will be
MS03-013 - MS03-017 is right after it. The rest will come, but I'm not
going to commit to a schedule, as it's too easy to derail. When QFE's are
available, we'll post a notice to the newsgroup.