M100704: MBSA 1.2 and 2.0 incompatibilities

The requirement for security bulletin MS04-030 (Vulnerability in WebDAV XML Message Handler Could Lead to a Denial of Service) is reported differently by MBSA 1.2 and 2.0. 

MBSA 1.2 reports that the patch is required. MBSA incorrectly reports that the patch is not required. ManageSoft Security Manager uses the MBSA 2.0 data, as it is expected to be most up-to-date. If both MBSA 1.2 and 2.0 are installed on the same managed device, manual intervention is required to install this patch.

To work around this problem, edit the ManageSoft package containing the patch, to specify that MBSA 1.2 data should have precedence over MBSA 2.0 data. Complete these steps:

1. Download and package MS04-030.
2. From the Packaging node of the ManageSoft administration console, open each package containing MS04-030 for editing.
3. Navigate to the Application Details node.
4. Right-click the Application Details node and select Properties.
5. Click the Custom tab.
6. Select PatchName and click Edit...

   The value displayed will be one of the following (the value will appear as one long line):

   • 223e8ec4-e891-4a44-918b-326307f313bc;
     Windows2000-KB824151-x86-DEU.EXE;
     Windows2000-KB824151-x86-ENU.EXE;
     Windows2000-KB824151-x86-FRA.EXE;
     Windows2000-KB824151-x86-JPN.EXE
   • 8434fc5d-acc9-4da3-a13a-9cdb40d6f92a;
     WindowsServer2003-KB824151-x86-deu.EXE;
     WindowsServer2003-KB824151-x86-enu.EXE;
     WindowsServer2003-KB824151-x86-fra.EXE;
     WindowsServer2003-KB824151-x86-jpn.EXE
   • d941680a-e2c9-4f32-8f5b-0578479b5a74;
     WindowSXP-KB824151-x86-deu.exe;
     WindowSXP-KB824151-x86-enu.EXE;
     WindowSXP-KB824151-x86-fra.EXE;
     WindowSXP-KB824151-x86-jpn.EXE;
     WindowsXP-KB824151-x86-deu.exe;
     WindowsXP-KB824151-x86-enu.EXE;
     WindowsXP-KB824151-x86-fra.EXE;
     WindowsXP-KB824151-x86-jpn.EXE
7. Select the content of the value from the beginning to the first semi-colon (;).
8. Cut this text and paste it at the end of the value.

   The value will now look like one of the following (the value will appear as one long line):

   • Windows2000-KB824151-x86-DEU.EXE;
     Windows2000-KB824151-x86-ENU.EXE;
     Windows2000-KB824151-x86-FRA.EXE;
     Windows2000-KB824151-x86-JPN.EXE;
     223e8ec4-e891-4a44-918b-326307f313bc
   • WindowsServer2003-KB824151-x86-deu.EXE;
     WindowsServer2003-KB824151-x86-enu.EXE;
     WindowsServer2003-KB824151-x86-fra.EXE;
     WindowsServer2003-KB824151-x86-jpn.EXE;
     8434fc5d-acc9-4da3-a13a-9cdb40d6f92a
   • WindowSXP-KB824151-x86-deu.exe;
     WindowSXP-KB824151-x86-enu.EXE;
     WindowSXP-KB824151-x86-fra.EXE;
     WindowSXP-KB824151-x86-jpn.EXE;
     WindowsXP-KB824151-x86-deu.exe;
     WindowsXP-KB824151-x86-enu.EXE;
     WindowsXP-KB824151-x86-fra.EXE;
     WindowsXP-KB824151-x86-jpn.EXE;
     d941680a-e2c9-4f32-8f5b-0578479b5a74
9. Save, close, and distribute the package.

   The change will cause the MBSA 1.2 detection to take precedence over the MBSA 2.0 detection, ensuring that ManageSoft clients will apply the bulletin. MBSA 2.0 uses the GUID string to match packages to security patches and MBSA 1.2 uses the executable filenames.