0

In Add / Remove programs there is a list of patches installed, also in the Help > About you can access all the Visual Studio patches.

971092 is an update to the visual studio service pack and doesnt appear to be listed in either of the above places.

How can I demonstrate I have installed it?

Related link - MS09-035: Vulnerabilities in Visual Studio Active Template Libraries could allow remote code execution

1 Answer 1

1

The MSKB article that you linked to also has a link to the full MS09-035 bulletin.

In that bulletin is a section named "Security Update Deployment", with sub-headings for each affected product. These sub-sections include information on which future service packs the hotfix will be included in, and details on how to verify patch installation by checking registry keys or product code verification. You can find more information regarding product code verification in MSKB 974653

The removal instructions for all listed products read: "Use Add or Remove Programs tool in Control Panel." -- so I'd expect to see it listed there if it is installed, until the point in time where you install a service pack that includes the hotfix.

Make sure you've checked "Show updates" in Add/remove programs, and make sure that you're not looking for the wrong KB number.

Also, ensure that the hotfix actually applies to your specific install and version of the product. The Microsoft Baseline Security Analyzer can help you here, also. It generally uses the same logic that Windows Update / Microsoft Update / Windows Server Update Services uses, and can even tell you if you are missing things that the main WU/MU servers think you should have, but that haven't yet been approved on your WSUS server.

For more information on this and other options for "do i even need this", see the "Detection and Deployment Tools and Guidance" section of the full security bulletin.

Final word of advice: Read and understand the full security bulletin and any relevant product-specific KB articles. Simply installing the hotfix may not be enough:

Developers who have built components and controls using ATL should download this update and recompile their components and controls following the guidance provided in the following MSDN article. [emphasis mine]

Sometimes complex vulnerabilities can't be solved with a simple (hah!) patch.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .