New Security Package, Tool

Microsoft is beginning to fulfill promises it made under the “Stay Secure” portion of its Strategic Technology Protection Program by releasing the first scheduled cumulative security hotfix for Windows 2000 and updating a tool that helps administrators determine which hotfixes have been applied on a computer.

Security Rollup Package 1

The Windows 2000 Security Rollup Package 1 (SRP1) delivers 19 separate hotfixes—all the hotfixes Microsoft has released to address operating system (OS) vulnerabilities identified in the security bulletins issued since Windows 2000 Service Pack 2—in a package that an administrator can apply as a single unit. Hotfixes issued after the release of SRP1 will come in future SRPs, which the company has promised to deliver every two months.

Missing from SRP1 is the hotfix for MS01-022 (Q296441): “WebDAV Service Provider Can Allow Scripts to Levy Requests as User.” The SRP does not include this hotfix because it does not affect Windows 2000 itself, but applies to the Microsoft Data Access Internet Publishing Provider, which is a code library for applications that retrieve and update documents with the Web Distributed Authoring and Versioning (WebDAV) protocol. Administrators will need to apply the WebDAV hotfix separately to most Windows 2000 systems that need SRP1.