Description of the Visio 2002 security update: October 12, 2004 (831932)


The information in this article applies to:

  • Microsoft Visio 2002 Professional
  • Microsoft Visio 2002 Standard

SUMMARY

Microsoft has released a software update for Microsoft Visio 2002. This article describes how to download and install the Visio 2002 security update: KB831932.

Article contents

INTRODUCTION

This update fixes a vulnerability where a specially crafted image could allow an attacker's code to run on a user's computer because of a vulnerability in the graphic's interpreter code.

Microsoft has released security bulletin MS04-028. The security bulletin contains all the relevant information about the security update, including file manifest information and deployment options. To view the whole security bulletin, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/bulletin/ms04-028.mspx

Release history:
  • Visio 2002 security update: KB831932 Version 1.0 - Released September 14, 2004
  • Visio 2002 security update: KB831932 Version 2.0 - Released October 12, 2004
The Visio 2002 security update: KB831932 Version 2.0 that was released October 12, 2004 addresses a patching issue that occurs when you apply the update on a computer where MSI 3.0 is installed. We recommend that all users who have Microsoft Windows XP Service Pack 2 (SP2) installed run the current version of the update even if an earlier version is installed.

back to the top

MORE INFORMATION

Installation details

Download and install the update

Client update

Important Before you install this update, make sure that you meet the following requirements:
  • Your computer is running one of the following operating systems:
    • Microsoft Windows 2000
    • Microsoft Windows Millennium Edition (Me)
    • Microsoft Windows 98 Second Edition
    • Microsoft Windows 98
    Note The Gdiplus.dll file that is contained in the Visio 2002 security update: KB831932 is installed only on computers that are running Microsoft Windows 2000 and earlier versions of Microsoft Windows. If you are running Microsoft Windows XP or Microsoft Windows Server 2003, you must obtain the latest version of the Gdiplus.dll file from the Microsoft Windows Update Web site. To do this, visit the following Microsoft Web site:

    http://v4.windowsupdate.microsoft.com

  • You have Microsoft Visio 2002 Service Pack 2 (SP2) installed on your computer.

    Before you install this update, you must install Visio 2002 SP2.

    For more information, click the following article number to view the article in the Microsoft Knowledge Base:

    830242 Description of Microsoft Visio 2002 Service Pack 2

    If you are an administrator, note the following:
    • Administrators who do not want to install Visio 2002 SP2, and who want to install this update on a computer that is running Microsoft Visio 2002 Service Release 1 (SR1) can follow the steps that are listed in the "Methods for installing the update on a computer that is running Visio 2002 SR-1 (for administrative users only)" section.

      We recommend that you install the latest service pack for Visio 2002 to make sure that you have the latest updates for Microsoft Visio.
    • You cannot install this update on a version of Visio that is earlier than Visio 2002 SR-1.
  • You have Microsoft Windows Installer version 2.0 or a later version installed on your computer.

    For additional information about this requirement, see the "Windows Installer update requirements" section.
If you installed Visio 2002 from a CD, use one of the following methods:
  • Use the Office Update Web site to automatically install all the latest updates that include all available service packs and public updates.
  • Install only the Visio 2002 security update: KB831932. To do this, follow the steps that are described later in this article.
Note We recommend that you install the client update by using the Office Update Web site. The Office Update Web site detects your particular installation of Microsoft Visio and prompts you to install exactly what you must have to make sure that your Visio installation is up-to-date.

Office Update Web site

To have the Office Update Web site detect the required updates that you have to install on your computer, visit the following Microsoft Web site:

http://office.microsoft.com/ProductUpdates/default.aspx

After detection is complete, you receive a list of recommended updates for your approval. Click Start Installation to complete the process.

Install only the Visio 2002 security update: KB831932

To download and install the update, follow these steps:
  1. To download the update, visit the following Microsoft Web site:

    http://www.microsoft.com/downloads/details.aspx?FamilyId=16C2DFFD-7B73-43C4-AB0D-2B5EFC80EB63

    Note A localized version of the update is also available at this Web site.
  2. Click Save to save the Visio2002-KB831932-v2-FullFile-ENU.exe file to the selected folder.
  3. In Microsoft Windows Explorer, locate the folder where you downloaded the file, and then double-click the Visio2002-KB831932-v2-FullFile-ENU.exe file.
  4. When you are prompted to install the update, click Yes.
  5. Read the license agreement, and if you agree, click Yes to accept the license agreement.
  6. If you are prompted to, insert the Visio 2002 installation CD into your computer's CD or DVD drive, and then click OK.
Note After you install the update, you cannot remove it. To revert to an installation before the update was installed, you must remove Visio 2002, and then install Visio 2002 again from the original CD-ROM.

back to the top

Administrative update

If you installed Visio 2002 from a server location, the server administrator must update the server location with the administrative update and deploy that update to your computer.

If you are the server administrator, follow these steps to update the administrative and client installations:
  1. To download the full-file update, visit the following Microsoft Web site:

    http://www.microsoft.com/downloads/details.aspx?FamilyId=16C2DFFD-7B73-43C4-AB0D-2B5EFC80EB63

    Note A localized version of the full-file update is also available at this Web site.
  2. In Microsoft Windows Explorer, create a new folder on drive C, and then name the folder KB831932.
  3. Click Save to save the Visio2002-KB831932-v2-FullFile-ENU.exe file to the C:\KB831932 folder.
  4. Click Start, click Run, type cmd in the Open box, and then click OK.
  5. At the command prompt, type the following lines, pressing ENTER after each line:

    cd\kb831932
    Visio2002-KB831932-v2-FullFile-ENU.exe /c /t:c:\kb831932

  6. Click Yes to accept the license agreement.
  7. At the command prompt, type exit to quit Command Prompt.
  8. If you are familiar with the procedure for updating your administrative installation, follow these steps:
    1. Click Start, click Run, type the following command in the Open box, and then click OK:

      msiexec /a Admin Path\MSI File /p c:\kb831932\MSP File

      In this command, Admin Path is the path of your administrative installation point for Visio 2002--for example, C:\Visio2002, MSI File is the .msi database package for Visio 2002--for example, Visio.msi, and MSP File is the name of the update--for example, Visio2002-KB831932-GDI-FullFile.msp.
    2. Click Start, click Run., type the following command in the Open box, and then click OK:

      msiexec /a Admin Path\MSI File /p c:\kb831932\MSP File

      In this command, Admin Path is the path of your administrative installation point for Visio 2002--for example, C:\Visio2002, MSI File is the .msi database package for Visio 2002--for example, Visio.msi, and MSP File is the name of the update--for example, Visio2002-KB831932-MSO-FullFile.msp.
    Notes
    • Visio 2002 does not support the SHORTFILENAMES=TRUE parameter.
    • You can append the /qb+ switch to the command line so that the End User License Agreement dialog box does not appear.
  9. To deploy the update to the client workstations, click Start, click Run, type the following command in the Open box, and then click OK:

    msiexec /i Admin Path\MSI File /qb REINSTALL=Feature List REINSTALLMODE=vomu

    In this command, Admin Path is the path of your administrative installation point for Visio 2002--for example, C:\Visio2002, MSI File is the MSI database package for Visio 2002, and Feature List is the case-sensitive list of feature names that must be reinstalled for the update. To install all features, you can use the REINSTALL=ALL property, or you can install the following feature:

    Program_Files

For more information about how to update your administrative installation and deploy to client workstations, click the following article number to view the article in the Microsoft Knowledge Base:

301348 How to install a public update to administrative installations of Office XP

back to the top

Methods for installing the update on a computer that is running Visio 2002 SR-1 (for administrators only)

If you are an administrator, and you want to install this update on Visio 2002 SR-1, use one of the following methods, depending on your situation.

Method 1: Modify the OHotfix.ini file

Use this method if you are an administrator, and you use the Ohotfix.exe program to install updates. Manually modify the OHotfix.ini file to change the RequireAllProductsAtMinVersion=1 setting to RequireAllProductsAtMinVersion=0 and to change the MinProductVersion=10.2.5110 setting to MinProductVersion=. To use this method, you have to extract the .msp files from the executable (.exe) file of the update. For more information about how to extract the .msp files from the .exe file, see the "Administrative update" section.

To modify the OHotfix.ini file, follow these steps:
  1. Start Notepad, and then open the OHotfix.ini file.
  2. Locate the following line:

    RequireAllProductsAtMinVersion=1

  3. Change the line to the following:

    RequireAllProductsAtMinVersion=0

  4. Locate the following line:

    MinProductVersion=10.2.5110

  5. Change the line to the following:

    MinProductVersion=

  6. Save the OHotfix.ini file.
For more information about how to install updates by using the OHotfix.exe program, visit the following Microsoft Web site:

http://office.microsoft.com/en-us/FX011511511033.aspx

back to the top

Method 2: Use the Msiexec.exe /p command line to install the update

Use this following method if you are an administrator, and you use the Msiexec.exe command to install updates. Do not use this method if you are updating an administrative image or if you are updating an administrative installation point.

Use the Msiexec.exe /p command line to install the .msp files that are required for Visio 2002. To use this method, you have to extract the .msp files from the executable (.exe) file of the update. For more information about how to extract the .msp files from the .exe file, see the "Administrative update" section.

The following is an example of the command lines that you can use to install this update by using the Msiexec.exe /p command:

Msiexec.exe /p Path\Visio2002-KB831932-GDI-FullFile-ENU.msp /qb- /L*v c:\GDILog.txt

Msiexec.exe /p Path\Visio2002-KB831932-MSO-FullFile-ENU.msp /qb- /L*v c:\MSOLog.txt

back to the top

Determine whether the update is installed

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
File name      Version
----------------------------
Mso.dll        10.0.6714.0
Gdiplus.dll    5.1.3102.1360


To determine whether the update is installed on your computer, follow these steps:

Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.
  1. Click Start, and then click Search.
  2. Under Search Companion, click All files and folders.
  3. In the All or part of the file name box, type Mso.dll, and then click Search.
  4. In the right pane, right-click the Mso.dll file, and then click Properties.
  5. On the General tab, verify the Created date, time, and size of the Mso.dll file.
Note If the Visio 2002 security update: KB831932 is already installed on your computer, you receive the following error message when you try to install the Visio 2002 security update: KB831932:
This update has already been applied or is included in an update that has already been applied.
back to the top

Windows Installer update requirements

To install the update that is described in this article, you must have Windows Installer 2.0 or a later version installed on your computer. Note that Windows 2000 Service Pack 3 (SP3) and later versions include Windows Installer 2.0 or a later version.

To install the latest version of the Windows Installer, visit one of the following Microsoft Web sites: back to the top

List of issues that are fixed in the update

The Visio 2002 security update: KB831932 update contains the following fixes and updates that were previously not documented in the Microsoft Knowledge Base:
  • Buffer overrun vulnerability where a specially crafted image file could permit an attacker to run malicious code
    A vulnerability in the graphics interpreter code where a specially crafted image file that is inserted to a Visio drawing could permit an attacker to run malicious code on a user's computer.
  • Improvements to GDI+ and how .jpeg and .tiff files are processed
    The Visio 2002 security update: KB831932 update includes improvements to GDI+ functionality and the way that .jpeg and .tiff files are processed.

back to the top

REFERENCES

If you are an administrator, you may want to install all the required GDI+ security updates in one 'batch' process.
For more information about how to create and use a batch file to silently install multiple GDI+ security updates, click the following article number to view the article in the Microsoft Knowledge Base:

885885 How to create and use a batch file to silently install multiple GDI+ security updates

For more information a known issue that may occur when you install the original version of this update, released September 14, on a Windows XP Service Pack 2-based computer, click the following article number to view the article in the Microsoft Knowledge Base:

885876 Important information that you must know about the MS04-028 security updates if you are using Windows XP Service Pack 2

For more information about deployment, click the following article numbers to view the articles in the Microsoft Knowledge Base:

885920 How to detect clients that require Critical Security Update MS04-028 in Systems Management Server 2003

886988 How to obtain and use the MS04-028 Enterprise Update Scanning Tool

Modification Type:MajorLast Reviewed:4/3/2006
Keywords:KbSECBulletin ATdownload kbSecurity kbUpdate kbfix kbBug KB831932 kbAudITPRO kbAudEndUser
©2004 Microsoft Corporation. All rights reserved.