Revisions:
• V1.0 April 13, 2004: Bulletin published
• V2.0 May 11, 2004: Microsoft has released a revised version of the Windows XP security update that contains the correctly localized optional Jet error strings

Microsoft Security Bulletin MS04-014
Vulnerability in the Microsoft Jet Database Engine Could Allow Code Execution (837001)

Issued: April 13, 2004
Updated: May 11, 2004
Version: 2.0
Summary

Who should read this document: Customers who use Microsoft® Windows®

Impact of vulnerability: Remote Code Execution

Maximum Severity Rating: Important

Recommendation: Customers should install the update at the earliest opportunity.

Security Update Replacement: None

Caveats: None

Tested Software and Security Update Download Locations:

Affected Software:
• Microsoft Windows NT® Workstation 4.0 Service Pack 6a – Download the update
• Microsoft Windows NT Server 4.0 Service Pack 6a – Download the update
• Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6 – Download the update
• Microsoft Windows 2000 Service Pack 2, Microsoft Windows 2000 Service Pack 3, and Microsoft Windows 2000 Service Pack 4 – Download the update
• Microsoft Windows XP and Microsoft Windows XP Service Pack 1 – Download the update
• Microsoft Windows XP 64-Bit Edition Service Pack 1 – Download the update
• Microsoft Windows XP 64-Bit Edition Version 2003 – Download the update
• Microsoft Windows Server™ 2003 – Download the update
• Microsoft Windows Server 2003 64-Bit Edition – Download the update
• Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME) – Review the FAQ section of this bulletin for details about these operating systems.

Tested Microsoft Windows Components:

Affected Components:
• Microsoft Jet Database Engine version 4.0

The software that is listed above has been tested to determine if the versions are affected. Other versions either no longer include security update support or may not be affected. To determine the support lifecycle for your product and version, visit the following Microsoft Support Lifecycle Web site.

• Microsoft Windows XP 64-Bit Edition Service Pack 1 – Download the update
• Microsoft Windows XP 64-Bit Edition Version 2003 – Download the update

Microsoft updated this bulletin on May 11, 2004 to advise on the availability of a revised version of the security update for non-English versions of Windows XP (as opposed to Windows XP Service Pack 1). The original update does address the vulnerability in Windows XP for all supported languages; however, the original update was not fully localized. Specifically, optional Jet error strings were only being offered in English on Windows XP. This issue does not affect other operating systems. If you have previously applied the security update for other operating systems, including Windows XP Service Pack 1, you need not take any additional action.

If you have previously applied the security update for non-English versions of Windows XP (as opposed to Windows XP Service Pack 1), you need not take any additional action as you are already protected from this vulnerability. However, if you want to have the Jet optional text error information in the same language as your Windows XP installation, you will need to remove the original security update MS04-014 (837001) following the Removal Information procedure located in this document and install the revised version. Once 837001 is uninstalled, revisiting Windows Update will result in the revised MS04-014 security update for Windows XP being re-offered with the correct, localized, optional text error strings.