RE: 26 June 2002 Cumulative Patch for Windows Media Player (Q320920)

["Coffin, Chris" <ccoffin () bindview com>]

Yes i am seeing something similar on a Windows XP system.
Patch had already been applied to the system but windows 
update notification prompted for the update again 
recently. Before applying the patch a second time, 
I checked the four files associated with the update 
found here:
HKLM\SOFTWARE\Microsoft\Updates\Windows Media Player\wm320920\FileList
The four files were present and matched what was in 
the registry FileList as far as version numbers go. 
Since the registry key and the files were already 
updated and i was being asked to patch once again, 
it would seem that there is a problem with the 
microsoft windows update catalog regarding this patch, 
though i haven't looked into this any further.

Another issue (could be related) noticed with this 
patch is that it does not update the dllcache with the 
new files installed by the patch. For those of you not 
familiar with the purpose of the dllcache directory, it 
is the Windows File Protection file store. If a WFP 
protected file (many files within the systemroot dir are 
monitored by WFP) is deleted, renamed, corrupted, or 
whatever... WFP will take the copy it has within the 
dllcache (if it exists) and replace the broken or 
missing file automatically without ever prompting the 
user. A stroll through some of the other patch FileLists 
and you'll notice that most all of them will update the 
dllcache.

Since the patched media player files are not installed 
into the dllcache directory, it's entirely possible 
that these files could get reverted at some point. I 
found an archived ntbugtraq post
http://archives.neohapsis.com/archives/ntbugtraq/2002-q2/0072.html
that mentions a similar issue with an earlier media 
player patch. The issue pointed out in the ntbugtraq 
post is really the same issue. What is occuring 
is that the earlier media player patch did not 
update the dllcache dir, and after running the System 
File Checker utility he noticed that the one of the 
patched files had been reverted to an earlier version.
So for those of you out there that are using the SFC
utility, you may want to look at your media player 
file versions and make sure they are the latest.


Chris

 

-----Original Message-----
From: Szulc Roger [mailto:roger_szulc () yahoo com]
Sent: Thursday, July 25, 2002 1:18 PM
To: bugtraq () securityfocus com
Subject: 26 June 2002 Cumulative Patch for Windows Media Player
(Q320920)


This update does not complete if you download it and
try it manually or even if you use the windowsupdate
site. It still shows up as an update that needs to be
installed. I have even tried to uninstall media player
7.1 and reinstall, then apply the patch and it does
not work. This testing was done on 3 Windows 2000
machines and all with the same results.

Roger Szulc

__________________________________________________
Do You Yahoo!?
Yahoo! Health - Feel better, live better
http://health.yahoo.com