Vulnerability Severity Rating and Maximum Security Impact by Affected Software
Affected Software	Microsoft XML Core Services Vulnerability – CVE-2007-2223	Aggregate Severity Rating
Windows 2000
Microsoft XML Core Services 3.0 on Windows 2000 Service Pack 4	Critical Remote Code Execution	Critical
Microsoft XML Core Services 4.0 when installed on Windows 2000 Service Pack 4	Critical Remote Code Execution	Critical
Microsoft XML Core Services 6.0 when installed on Windows 2000 Service Pack 4	Critical Remote Code Execution	Critical
Windows XP
Microsoft XML Core Services 3.0 on Windows XP Service Pack 2	Critical Remote Code Execution	Critical
Microsoft XML Core Services 3.0 on Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2	Critical Remote Code Execution	Critical
Microsoft XML Core Services 4.0 when installed on Windows XP Service Pack 2	Critical Remote Code Execution	Critical
Microsoft XML Core Services 4.0 when installed on Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2	Critical Remote Code Execution	Critical
Microsoft XML Core Services 6.0 when installed on Windows XP Service Pack 2	Critical Remote Code Execution	Critical
Microsoft XML Core Services 6.0 when installed on Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2	Critical Remote Code Execution	Critical
Windows Server 2003
Microsoft XML Core Services 3.0 on Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2	Moderate Remote Code Execution	Moderate
Microsoft XML Core Services 3.0 on Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2	Moderate Remote Code Execution	Moderate
Microsoft XML Core Services 3.0 on Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems	Moderate Remote Code Execution	Moderate
Microsoft XML Core Services 4.0 when installed on Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2	Moderate Remote Code Execution	Moderate
Microsoft XML Core Services 4.0 when installed on Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2	Moderate Remote Code Execution	Moderate
Microsoft XML Core Services 4.0 when installed on Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems	Moderate Remote Code Execution	Moderate
Microsoft XML Core Services 6.0 when installed on Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2	Moderate Remote Code Execution	Moderate
Microsoft XML Core Services 6.0 when installed on Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2	Moderate Remote Code Execution	Moderate
Microsoft XML Core Services 6.0 when installed on Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems	Moderate Remote Code Execution	Moderate
Windows Vista
Microsoft XML Core Services 3.0 on Windows Vista	Critical Remote Code Execution	Critical
Microsoft XML Core Services 3.0 on Windows Vista x64 Edition	Critical Remote Code Execution	Critical
Microsoft XML Core Services 4.0 when installed on Windows Vista	Critical Remote Code Execution	Critical
Microsoft XML Core Services 4.0 when installed on Windows Vista x64 Edition	Critical Remote Code Execution	Critical
Microsoft XML Core Services 6.0 on Windows Vista	Critical Remote Code Execution	Critical
Microsoft XML Core Services 6.0 on Windows Vista x64 Edition	Critical Remote Code Execution	Critical
Office Suite
Office 2003 Service Pack 2 with Microsoft XML Core Services 5.0	Critical Remote Code Execution	Critical
2007 Office System with Microsoft XML Core Services 5.0	Critical Remote Code Execution	Critical
2007 Office System with Microsoft XML Core Services 6.0	Critical Remote Code Execution	Critical
Office SharePoint Server with Microsoft XML Core Services 5.0	Critical Remote Code Execution	Critical
Office Groove Server 2007 with Microsoft XML Core Services 5.0	Critical Remote Code Execution	Critical

A remote code execution vulnerability exists in Microsoft XML Core Services that could allow an attacker who successfully exploited this vulnerability to make changes to the system with the permissions of the logged-on user. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2007-2223.

Manage the software and security updates you need to deploy to the servers, desktop, and mobile systems in your organization. For more information see the TechNet Update Management Center. The Microsoft TechNet Security Web site provides additional information about security in Microsoft products.

Security updates are available from Microsoft Update, Windows Update, and Office Update. Security updates are also available at the Microsoft Download Center. You can find them most easily by doing a keyword search for "security_patch." Finally, security updates can be downloaded from the Windows Update Catalog. For more information about the Windows Update Catalog, see Microsoft Knowledge Base Article 323166.

Detection and Deployment Guidance

Microsoft has provided detection and deployment guidance for this month’s security updates. This guidance will also help IT professionals understand how they can use various tools to help deploy the security update, such as Windows Update, Microsoft Update, Office Update, the Microsoft Baseline Security Analyzer (MBSA), the Office Detection Tool, Microsoft Systems Management Server (SMS), the Extended Security Update Inventory Tool, and the Enterprise Update Scan Tool (EST). For more information, see Microsoft Knowledge Base Article 910723.

Microsoft Baseline Security Analyzer

Microsoft Baseline Security Analyzer (MBSA) allows administrators to scan local and remote systems for missing security updates as well as common security misconfigurations. For more information about MBSA visit Microsoft Baseline Security Analyzer Web site.

The following table provides the MBSA detection summary for this security update.

Software	MBSA 1.2.1	MBSA 2.0.1
Windows 2000 Service Pack 4	Yes	Yes
Windows XP Service Pack 2	Yes	Yes
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2	No	Yes
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2	Yes	Yes
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2	No	Yes
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems	No	Yes
Windows Vista	No	See Note for Windows Vista below
Windows Vista x64 Edition	No	See Note for Windows Vista below
Office 2003 Service Pack 2	Yes[1]	Yes
2007 Office system	Yes[1]	Yes
Office SharePoint Server 2007	Yes[1]	Yes
Office Groove Server 2007	Yes[1]	Yes
Microsoft XML Core Services 4.0	Yes	Yes
Microsoft XML Core Services 6.0	Yes	Yes

[1]MBSA 1.2.1 supports detection of this security update only as a local scan. MBSA 1.2.1 uses an integrated version of the Office Detection Tool (ODT) which does not support remote scans of this security update. For more information about MBSA, visit the MBSA Web site.

Note for Windows Vista Microsoft does not support installing MBSA 2.0.1 on systems that run Windows Vista, but you may install MBSA 2.0.1 on a supported operating system and then scan the Windows Vista-based system remotely. For additional information about MBSA support for Windows Vista, visit the MBSA Web site. See also Microsoft Knowledge Base Article 931943: Microsoft Baseline Security Analyzer (MBSA) support for Windows Vista.

For more information about MBSA, visit the MBSA Web site. For more information about the software that Microsoft Update and MBSA 2.0 currently do not detect, see Microsoft Knowledge Base Article 895660.

Windows Server Update Services

By using Windows Server Update Services (WSUS), administrators can deploy the latest critical updates and security updates for Windows 2000 operating systems and later, Office XP and later, Exchange Server 2003, and SQL Server 2000 to Windows 2000 and later operating systems. For more information about how to deploy this security update using Windows Server Update Services, visit the Windows Server Update Services Web site.

Systems Management Server

The following table provides the SMS detection and deployment summary for this security update.

Software	SMS 2.0	SMS 2003
Microsoft Windows 2000 Service Pack 4	Yes	Yes
Microsoft Windows XP Service Pack 2	Yes	Yes
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2	No	Yes
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2	Yes	Yes
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2	No	Yes
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems	No	Yes
Windows Vista	No	See Note for Windows Vista below
Windows Vista x64 Edition	No	See Note for Windows Vista below
Office 2003 Service Pack 2	Yes	Yes
2007 Office System	Yes	Yes
Office SharePoint Server	Yes	Yes
Office Groove Server 2007	Yes	Yes
Microsoft XML Core Services 4.0	Yes	Yes
Microsoft XML Core Services 6.0	Yes	Yes

For SMS 2.0, the SMS SUS Feature Pack, which includes the Security Update Inventory Tool (SUIT), can be used by SMS to detect security updates. SMS SUIT uses the MBSA 1.2.1 engine for detection. For more information about SUIT, visit the following Microsoft Web site. For more information about the limitations of SUIT, see Microsoft Knowledge Base Article 306460. The SMS SUS Feature Pack also includes the Microsoft Office Inventory Tool to detect required updates for Microsoft Office applications.

For SMS 2003, the SMS 2003 Inventory Tool for Microsoft Updates (ITMU) can be used by SMS to detect security updates that are offered by Microsoft Update and that are supported by Windows Server Update Services. For more information about the SMS 2003 ITMU, visit the following Microsoft Web site. SMS 2003 can also use the Microsoft Office Inventory Tool to detect required updates for Microsoft Office applications.

Note for Windows VistaMicrosoft Systems Management Server 2003 with Service Pack 3 includes support for Windows Vista manageability.

For more information about SMS, visit the SMS Web site.

Note If you have used an Administrative Installation Point (AIP) for deploying Office 2000, Office XP or Office 2003, you may not be able to deploy the update using SMS if you have updated the AIP from the original baseline. For more information, see the Office Administrative Installation Point heading in this section.

Office Administrative Installation Point

If you installed your application from a server location, the server administrator must update the server location with the administrative update and deploy that update to your system.

•

For supported versions of Microsoft Office 2003, see Creating an Administrative Installation Point. If you have an Administrative Installation Point with a non-supported version of Microsoft Office 2003, see Microsoft Knowledge Base Article 902349. Note. If you plan to manage software updates centrally from an updated administrative image, you can find more information in the article Distributing Office 2003 Product Updates. For supported versions of the 2007 Microsoft Office system, see Create a network installation point for the 2007 Office system.

•

For supported versions of the 2007 Microsoft Office system, see Create a network installation point for the 2007 Office system. Note. If you plan to manage security updates centrally use Windows Server Update Services. For more information about how to deploy security updates for the 2007 Microsoft Office system using Windows Server Update Services, visit the Windows Server Update Services Web site.