## AVS Standard Client 2.2 Baseline

## Current Build Components and Revision History

## May 28, 2008

AVS has adopted a standardized client [baseline]{.underline}
configuration to improve client support, security and maintenance across
the AVS enterprise. The AVS [baseline]{.underline} components should not
be changed, nor should additional baseline security updates be applied
without approval and notification from the AVS Client Management (CM)
team. CM approved, Standard Client 2.2 critical security updates (both
individual and a roll-up package) can be located on the SC 2.x
SharePoint site
([http://avssharepoint.faa.gov/avs11/CM/SC20/SC%2020%20Baseline%20Updates/Forms/AllItems.aspx](http://avssharepoint.faa.gov/avs11/CM/SC20/SC 20 Baseline Updates/Forms/AllItems.aspx)).
Note that additional security updates may be required to address
high-risk vulnerabilities with additional **non-baseline** software and
applications installed onto the Standard Client 2.2 baseline.

+---------------------------------------+------------------------------+
| **Current AVS Standard Client 2.2     |                              |
| Baseline Components**                 |                              |
+=======================================+==============================+
| **Application/Component**             | **Version**                  |
|                                       |                              |
| **([\*\*\*]{.mark} indicates change   |                              |
| from original 2.0 baseline)**         |                              |
+---------------------------------------+------------------------------+
| Windows Operating System              | Windows XP Professional      |
+---------------------------------------+------------------------------+
| O/S Service Pack                      | SP2 slipstreamed             |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}Microsoft Internet     | 6.0.2900.2180.xpsp_s         |
| Explorer                              | p2\_[qdr.050301-1519]{.mark} |
|                                       | (may change with each IE     |
|                                       | security update)             |
+---------------------------------------+------------------------------+
| MS IE Update Version                  | Service Pack 2               |
+---------------------------------------+------------------------------+
| DirectX                               | 9.0c                         |
+---------------------------------------+------------------------------+
| Microsoft Data Access Components      | 2.8                          |
| (MDAC)                                |                              |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}Adobe Acrobat Reader   | 8.1.1                        |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}Winzip Pro             | 11.1                         |
+---------------------------------------+------------------------------+
| Microsoft .NET Framework              | 1.1 SP1 (1.1.4322.573)\      |
|                                       | ndp1.1sp1-kb886903-x86.exe   |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}Microsoft .NET         | 2.0 (2.0.50727)              |
| Framework                             |                              |
+---------------------------------------+------------------------------+
| Microsoft Office Suite                | Office 2003 Professional     |
|                                       | 11.0.x\                      |
|                                       | Access, Excel, InfoPath,     |
|                                       | PowerPoint, Publisher, Word, |
|                                       | Tools                        |
+---------------------------------------+------------------------------+
| Office Service Pack                   | Service Pack 2               |
+---------------------------------------+------------------------------+
| Visual Basic Runtime Library          | 6.00.97.82 (SP6)             |
+---------------------------------------+------------------------------+
| Windows Media Player                  | 10.00.00.4036                |
+---------------------------------------+------------------------------+
| Visio Viewer                          | 2003 11.0.3709.5614          |
+---------------------------------------+------------------------------+
| Remote Desktop Web Connection         | 5.2.3790                     |
+---------------------------------------+------------------------------+
| TrendMicro OfficeScan Client          | 7.0                          |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}Macromedia Shockwave   | 10.2.0.023                   |
| Player                                |                              |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}Macromedia Flash       | 9.0.47.0                     |
| Player                                |                              |
+---------------------------------------+------------------------------+
| Macromedia Authorware Player          | 2004.0.0.73                  |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}Apple QuickTime Player | 7.3                          |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}vBrick CODEC/Player    | 4.2                          |
+---------------------------------------+------------------------------+
| OPSS (pre-install)                    | 6.0.80.22                    |
+---------------------------------------+------------------------------+
| SPAS ActiveX Controls                 | (as of Dec 2006)             |
|                                       |                              |
| -   Ack Text Control 5.0.0.19         |                              |
|                                       |                              |
| -   AcxCalendar Control 2.0.0.36      |                              |
|                                       |                              |
| -   AcxStache Control 2.0.0.12        |                              |
|                                       |                              |
| -   FAAWebMenu Control 1.0.1.0        |                              |
|                                       |                              |
| -   SPAS II Check List 2.0.0.13       |                              |
|                                       |                              |
| -   SPAS II Graph 2.0.0.58            |                              |
|                                       |                              |
| -   SPAS II Table 2.0.0.51            |                              |
|                                       |                              |
| -   SPAS_SpellCheck Control 2.0.0.6   |                              |
|                                       |                              |
| -   SPASHelp Control 2.0.0.2          |                              |
|                                       |                              |
| -   SpasImg Control 2.0.0.9           |                              |
|                                       |                              |
| -   SpasMaskedEdit.SpasMaskEdit       |                              |
|     2.0.0.0                           |                              |
+---------------------------------------+------------------------------+
| KMS Conferencing web control          | 6.0.5762.0                   |
+---------------------------------------+------------------------------+
| Citrix Metaframe Client               | 9.100.36280                  |
+---------------------------------------+------------------------------+
| WEBCBT (Smartforce)                   | 2.64                         |
+---------------------------------------+------------------------------+
| WEBCBT (Smartforce Ireland Plug-in)   | 1.0.1.0                      |
+---------------------------------------+------------------------------+
| WEBCMI (Macromedia Authorware)        | 7.0.0.70                     |
+---------------------------------------+------------------------------+
| WS_FTP                                | 5.08 Limited Edition (LE)    |
+---------------------------------------+------------------------------+
| NS/Elite                              | 3.12.01                      |
+---------------------------------------+------------------------------+
| NS/Elite TN3270                       | TN3270                       |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}FAANET OpenConnect     | 6..6.4 - Links to            |
| Shortcut                              | <http://m                    |
|                                       | frconnect.amc.faa.gov:2080/> |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}FAAMIS Desktop         | http://faamis.avs.faa.gov/   |
| Shortcut                              |                              |
+---------------------------------------+------------------------------+
| Diskeeper                             | 8.0.478.0                    |
+---------------------------------------+------------------------------+
| Lotus Notes                           | 6.5.1                        |
+---------------------------------------+------------------------------+
| QuickPlace Upload web control         | 6.5.1                        |
+---------------------------------------+------------------------------+
| Sametime Connect Client (Instant      | 3.0                          |
| Messaging)                            |                              |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}Sun Java Run-Time      | 1.6.0_03                     |
| Client                                |                              |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}Sametime Installer for | 6.5.1 Fix Pack 1             |
| Secure Desktops (SISD) for Sametime   |                              |
| Meeting Center 6.5.1                  |                              |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}SMS 2003 SP2 Advanced  | 2.50.4160.2000               |
| Client                                |                              |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}DjVu Viewer            | 6.0.1                        |
+---------------------------------------+------------------------------+
| Critical Updates (Microsoft Malicious | w                            |
| Software Removal Tool)                | indows-kb890830-v1.6-enu.exe |
+---------------------------------------+------------------------------+
| RGL Calendar Control                  | 10/2/1997                    |
+---------------------------------------+------------------------------+
| ACOS 95 Fonts (Lincoln/Kastler Bold   | Included                     |
| Italic/Kastler Italic)                |                              |
+---------------------------------------+------------------------------+
| ScriptX Web Print Control (Supports   | 6.1.432.1                    |
| CMIS)                                 |                              |
+---------------------------------------+------------------------------+
| SWING Web Control (Supports CMIS)     | 1.00.0498                    |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}Project Server 2003    | 2003                         |
| ActiveX controls                      |                              |
+---------------------------------------+------------------------------+
| CODECS                                | DIVX 6.0.3\                  |
|                                       | Techsmith                    |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}XVid CODECS            | 1.1                          |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}CSET PMT ActiveX       | 1.0.0.7                      |
| Control                               |                              |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}Domino Web Access      | 6.0.40.0                     |
| Upload Module ActiveX control (for    |                              |
| Notes web mail)                       |                              |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}SQL 2005 Reporting     | 2005.90.3042.0               |
| Services Print ActiveX Control        |                              |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}FPPS BlueZone 3270     | 3.5.3.601                    |
| ActiveX Control (Seagull Web-to-Host  |                              |
| Control Module v3)                    |                              |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}PassLogix v-GO Client  | 6.0.04                       |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}AVS "Standard Client   | 1.46                         |
| Tools" Utility                        |                              |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}Non-Security Office    | -   KB907417 (Excel/Word) -  |
| 2003 Updates                          |     <http://supp             |
|                                       | ort.microsoft.com/kb/907417> |
|                                       |                              |
|                                       | -   KB920103 (Infopath) -    |
|                                       |     <http://supp             |
|                                       | ort.microsoft.com/kb/920103> |
|                                       |                              |
|                                       | -   KB923095 (Outlook) -     |
|                                       |     <http://supp             |
|                                       | ort.microsoft.com/kb/923095> |
|                                       |                              |
|                                       | -   KB923097 (OpenXML        |
|                                       |     Support) -               |
|                                       |     <http://supp             |
|                                       | ort.microsoft.com/kb/923097> |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}Non-Security Windows   | -   Windows XP 2007          |
| XP Updates                            |     Cumulative Daylight      |
|                                       |     Savings Time (DST)       |
|                                       |     Update (KB931836)        |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}Microsoft Office 2007  | 12.x                         |
| Compatibility Pack                    |                              |
+---------------------------------------+------------------------------+
| [\*\*\*]{.mark}All CM Approved        | Thru MS08-028                |
| Microsoft Security Updates            |                              |
+---------------------------------------+------------------------------+

## AVS Standard Client 2.1 Baseline

## Build and Revision History

# January 11, 2006 -- Final AVS Standard Client Version 2.0 Baseline

**Description:** The AVS Windows XP Pro core standard operating system,
baseline applications, components, security updates and default
configuration settings.

**Source for Installation:** AVS Standard Client 2.0 Generic Ghost DVD
or SC 2.0 Scripted Installation CD/DVD dated January 11, 2006

**Justification:** Required for initial deployment of the SC 2.0 Windows
XP/Office 2003 client.

**Applications and components included:**

-   Microsoft Windows XP Professional SP2

-   Microsoft Internet Explorer 6.0.2900.2180.xpsp_sp2_rtm.040803-2158

-   Microsoft DirectX 9.0c

-   Microsoft Data Access Components (MDAC) 2.8

-   Adobe Acrobat Reader 7.0.5

-   Winzip Pro 10.0 Build 6667

-   Microsoft .NET Framework 1.1 SP1 (1.1.4322.573) with update
    ndp1.1sp1-kb886903-x86.exe

-   Microsoft Office 2003 Pro 11.0.5614 with Service Pack 2\
    Visual Basic Runtime Library 6.00.9783 (SP6)

-   Windows Media Player 10.00.00.3646

-   Visio Viewer 2003 11.0.3709.5614

-   Remote Desktop Web Connection 5.2.3790

-   TrendMicro OfficeScan Client 7.0

-   Macromedia Shockwave Player 10.1.r11

-   Macromedia Flash Player 8.0.22.0

-   Macromedia Authorware Player 2004.0.0.73

-   Apple QuickTime Player 7.0.3

-   OPSS (pre-install) 6.0.80.22

-   SPAS ActiveX Controls:

    1.  Ack Text Control 5.0.0.19

    2.  AcxCalendar Control 2.0.0.36

    3.  AcxStache Control 2.0.0.12

    4.  FAAWebMenu Control 1.0.1.0

    5.  SPAS II Check List 2.0.0.13

    6.  SPAS II Graph 2.0.0.58

    7.  SPAS II Table 2.0.0.51

    8.  SPAS_SpellCheck Control 2.0.0.6

    9.  SPASHelp Control 2.0.0.2

    10. SpasImg Control 2.0.0.9

    11. SpasMaskedEdit.SpasMaskEdit 2.0.0.0

-   KMS Conferencing web control 6.0.5762.0

-   Citrix Metaframe Client 9.100.36280

-   WEBCBT (Smartforce) 2.64

-   WEBCBT (Smartforce Ireland Plug-in) 1.0.1.0

-   WEBCMI (Macromedia Authorware) 7.0.0.70

-   WS_FTP 5.08 Limited Edition (LE)

-   NS/Elite 3.12.01

-   Diskeeper 8.0.478.0

-   Lotus Notes 6.5.1

-   QuickPlace Upload web control 6.5.1

-   Sametime Connect Client (Instant Messaging) 3.0

-   Sun Java Run-Time Client 1.5.0_05

-   Sametime Installer for Secure Desktops (SISD) 3.1 for Sametime
    Meeting Center 6.5.1

-   SMS 2003 Advanced Client 2.50.3174

-   Critical Updates (Microsoft Malicious Software Removal Tool)
    Windows-kb890830-v1.6-enu.exe

-   RGL Calendar Control - 10/2/1997

-   ACOS 95 Fonts (Lincoln/Kastler Bold Italic/Kastler Italic)

-   ScriptX Web Control (Supports CMIS) 6.1.432.1

-   SWING Web Control (Supports CMIS) 1.00.0498

-   CODECS - DIVX 6.0.3 and Techsmith

-   FPPS BlueZone 3270 ActiveX Control (Seagull Web-to-Host Control
    Module v3) 3.4.1.480

-   All CM Approved Microsoft Security Updates - Thru MS06-001

# January 19, 2006 - January 2006 Security Updates

-   MS06-002 - Vulnerability in Embedded Web Fonts Could Allow Remote
    Code Execution (908519)

-   MS06-003 - Vulnerability in TNEF Decoding in Microsoft Outlook and
    Microsoft Exchange Could Allow Remote Code Execution (902412) --
    KB892843

# February 27, 2006 - February 2006 Security Updates

-   MS06-005- Vulnerability in Windows Media Player Could Allow Remote
    Code Execution (911565)

-   MS06-006 - Vulnerability in Windows Media Player Plug-in with
    Non-Microsoft Internet Browsers Could Allow Remote Code Execution
    (911564)

-   MS06-007 - Vulnerability in TCP/IP Could Allow Denial of Service
    (913446)

-   MS06-008 - Vulnerability in Web Client Service Could Allow Remote
    Code Execution (911927)

# March 28, 2006 - March 2006 Security Updates

-   MS06-012 - Vulnerabilities in Microsoft Office Could Allow Remote
    Code Execution (905413) -- Includes Excel 2003 update KB905756

# April 21, 2006 - April 2006 Security Updates

-   MS06-013 Cumulative Security Update for Internet Explorer (912812)

-   MS06-014 Vulnerability in the Microsoft Data Access Components
    (MDAC) Function Could Allow Code Execution (911562)

-   MS06-015 Vulnerability in Windows Explorer Could Allow Remote Code
    Execution (908531)

-   MS06-016 Cumulative Security Update for Outlook Express (911567)

# April 28, 2006 -- Revised MS06-015 Security Update

-   MS06-015 Vulnerability in Windows Explorer Could Allow Remote Code
    Execution v2 (908531)

# May 19, 2006 - May 2006 Security Updates

-   MS06-018 - Vulnerability in Microsoft Distributed Transaction
    Coordinator Could Allow Denial of Service (913580)

# May 31, 2006 - iNotes6 Class ActiveX Control (Domino Web Access Upload Module) v. 6.0.40.0 for Lotus Notes Web Mail

-   iNotes6 ActiveX Control (Domino Web Access Upload Module) v.
    6.0.40.0

# June 22, 2006 - June 2006 Security Updates

-   MS06-021 - Cumulative Security Update for Internet Explorer (916281)

-   MS06-022 - Vulnerability in ART Image Rendering Could Allow Remote
    Code Execution (918439)

-   MS06-023 - Vulnerability in Microsoft JScript Could Allow Remote
    Code Execution (917344)

-   MS06-024 - Vulnerability in Windows Media Player Could Allow Remote
    Code Execution (917734)

-   MS06-025 - Vulnerability in Routing and Remote Access Could Allow
    Remote Code Execution (911280)

-   MS06-030 - Vulnerability in Server Message Block Could Allow
    Elevation of Privilege (914389)

-   MS06-032 - Vulnerability in TCP/IP Could Allow Remote Code Execution
    (917953)

-   MS06-027 - Vulnerability in Microsoft Word Could Allow Remote Code
    Execution (917336) - KB917334

-   MS06-028 - Vulnerability in Microsoft PowerPoint Could Allow Remote
    Code Execution (916768) -- KB916518

# July 20, 2006 - July 2006 Security Updates

-   MS06-025 - Vulnerability in Routing and Remote Access Could Allow
    Remote Code Execution (911280) -- **Revised June 22, 2006 - version
    2**

-   MS06-035 - Vulnerability in Server Service Could Allow Remote Code
    Execution (917159)

-   MS06-036 - Vulnerability in DHCP Client Service Could Allow Remote
    Code Execution (914388)

-   MS06-037 - Vulnerabilities in Microsoft Excel Could Allow Remote
    Code Execution (917285) -- KB918419

-   MS06-038 - Vulnerabilities in Microsoft Office Could Allow Remote
    Code Execution (917284) -- KB917151

-   MS06-039 - Vulnerabilities in Microsoft Office Filters Could Allow
    Remote Code Execution (915384) - KB914455 for Office 2003 SP2

# July 26, 2006 -- Passlogix v-GO 5.04 Client 

-   Per the e-mail announcement from Nick Sabatini and JoAnn Carroll,
    the v-GO 5.04 client was deployed to all AVS workstations. The SMS
    package "**AVS V-Go Client**" and a manual installation package was
    available to support the deployment.

# August 14, 2006 -- MS06-040 Security Update (expedited due to exploitation)

-   MS06-040 - Vulnerability in Server Service Could Allow Remote Code
    Execution (921883)

# August 18, 2006 - August 2006 Security Updates

-   MS06-041 - Vulnerabilities in DNS Resolution Could Allow Remote Code
    Execution (920683)

-   MS06-042 - Cumulative Security Update for Internet Explorer (918899)

-   MS06-043 - Vulnerability in Microsoft Windows Could Allow Remote
    Code Execution (920214)

-   MS06-045 - Vulnerability in Windows Explorer Could Allow Remote Code
    Execution (921398)

-   MS06-046 - Vulnerability in HTML Help Could Allow Remote Code
    Execution (922616)

-   MS06-048 - Vulnerabilities in Microsoft Office Could Allow Remote
    Code Execution (922968) -- KB921566 for Office 2003 SP2

-   MS06-050 - Vulnerabilities in Microsoft Windows Hyperlink Object
    Library Could Allow Remote Code Execution (920670)

-   MS06-051 - Vulnerability in Windows Kernel Could Result in Remote
    Code Execution (917422)

# September 21, 2006 - September 2006 Security Updates

-   MS06-052 - Vulnerability in Pragmatic General Multicast (PGM) Could
    Allow Remote Code Execution (919007)

-   MS06-053 - Vulnerability in Indexing Service Could Allow Cross-Site
    Scripting (920685)

-   MS06-054 (Publisher 2003) - Vulnerability in Microsoft Publisher
    Could Allow Remote Code Execution (910729) - KB894542

# October 3, 2006 -- MS06-055 Security Update (expedited due to exploitation)

-   MS06-055 - Vulnerability in Vector Markup Language Could Allow
    Remote Code Execution (925486)

# October 19, 2006 - October 2006 Security Updates

-   MS06-057 - Vulnerability in Windows Explorer Could Allow Remote
    Execution (923191)

-   MS06-058 - Vulnerabilities in Microsoft PowerPoint Could Allow
    Remote Code Execution (924163) - KB923091

-   MS06-059 - Vulnerabilities in Microsoft Excel Could Allow Remote
    Code Execution (924164) -

-   MS06-060 - Vulnerabilities in Microsoft Word Could Allow Remote Code
    Execution (924554) -- KB923094 - **Do NOT install on computers of
    OPSS users**

-   MS06-061 - Vulnerabilities in Microsoft XML Core Services Could
    Allow Remote Code Execution (924191)

-   MS06-061 - Security Update for Windows XP (KB924191) - Security
    Update for Office 2003 (KB924424)

-   MS06-062 - Vulnerabilities in Microsoft Office Could Allow Remote
    Code Execution (922581)

-   MS06-063 - Vulnerability in Server Service Could Allow Denial of
    Service (923414)

-   MS06-064 - Vulnerabilities in TCP/IP IPv6 Could Allow Denial of
    Service (922819)

-   MS06-065 - Vulnerability in Windows Object Packager Could Allow
    Remote Execution (924496)

-   Internet Explorer Hotfix KB923996 -
    <http://support.microsoft.com/kb/923996>

# November 22, 2006 - November 2006 Security Updates

-   MS06-066 - Vulnerability in Windows Explorer Could Allow Remote
    Execution (923191)

-   MS06-066 - Vulnerabilities in Client Service for NetWare Could Allow
    Remote Code Execution (923980)

-   MS06-067 - Cumulative Security Update for Internet Explorer (922760)

-   MS06-068 - Vulnerability in Microsoft Agent Could Allow Remote Code
    Execution (920213)

-   MS06-070 - Vulnerability in Workstation Service Could Allow Remote
    Code Execution (924270)

-   MS06-071 - Vulnerabilities in Microsoft XML Core Services 4.0 Could
    Allow Remote Code Execution (927978)

# December 21, 2006 - December 2006 Security Updates

-   MS06-072 - Cumulative Security Update for Internet Explorer (925454)

-   MS06-075 - Vulnerability in Windows Could Allow Elevation of
    Privilege (926255)

-   MS06-076 - Cumulative Security Update for Outlook Express (923694)

-   MS06-078 - Vulnerability in Windows Media Format Could Allow Remote
    Code Execution (923689) - Includes Security Update for Windows XP
    (KB923689) and Security Update for Windows Media Player 6.4 for
    Windows (KB925398)

# January 18, 2007 -- Final AVS Standard Client Version 2.1 Baseline Release

**Description:** A required minor release upgrade to the AVS Standard
Client 2.0 baseline which includes additional and upgraded baseline
applications, components, updates and configuration settings.

**Source for Installation:** AVS Standard Client 2.1 Generic Ghost DVD
or the SMS/Manual SC 2.1 Update package dated January 10, 2007.

**Justification:** Required to enhance the AVS SC baseline functionality
and maintain COTS compatibility and support.

**Additional and Upgraded Applications and Components include:**

-   Microsoft .NET Framework 2.0 (.NET Framework 1.1.4322 is also
    installed)

-   OpenConnect 3270 (web-based) FAANET shortcuts to the mainframe
    (replaces existing NS/Elite FAANET shortcuts)

-   Project 2003 Server ActiveX Web Controls (to support use of the AVS
    Project server)

-   DjVu viewer v. 6.0.1

-   iNotes6 Class ActiveX control (Domino Web Access Upload Module) v.
    6.0.40.0 for Lotus Notes web mail -- Provides enhanced attachment
    functionality in Notes web mail.

-   Windows XP Wi-Fi Protected Access 2 (WPA2)/Wireless Provisioning
    Services Information Element (WPS IE) Update
    ([KB893357](http://support.microsoft.com/?id=893357))

-   Pre-loaded FAA trusted root security certificate for NexGen web mail
    and Sametime Meeting Center

-   SQL 2005 Reporting Services Print ActiveX control (Reporting
    Services Client Print v. 2005.90.2047.0)

-   ActiveX control (CSETPMTControl ActiveX Control Module v. 1.0.0.7)
    to support the CSET Project Management Tool web application

-   Registry setting to prevent SharePoint security warning when opening
    documents via a SharePoint site

-   XviD CODEC package for latest DIVX and MPEG-4 support

-   Removed support for the POSIX sub-system (security vulnerability)

-   Added the entry "\*.govtrip.com" to the Internet Explorer Trusted
    Sites list to allow pop-up windows in GovTrip.

-   Adobe Acrobat Reader & Professional 7.0 certificate security
    settings to enable 337 certificate functions

-   Additional non-security Microsoft Office 2003 updates:

    1.  KB907417 - <http://support.microsoft.com/kb/907417>

    2.  KB920103 - <http://support.microsoft.com/kb/920103>

    3.  KB923095 - <http://support.microsoft.com/kb/923095>

    4.  KB923097 - <http://support.microsoft.com/kb/923097>

-   Apple QuickTime Player 7.1.3 (from 7.03)

-   Winzip Professional 10.0 Build 6698 (from 10.0 Build 6667)

-   Adobe Shockwave Player 10.1.4.020 (from 10.1.r11)

-   Adobe Flash Player 9.0.16.0 (from 8.0.22.0)

-   Updated device drivers for the supported AVS desktop/laptop
    platforms (GX-270,GX-280 Tower, GX-280 SFF, GX-620, D600, D610,
    D620, T41)

-   DivX 6.2.5 CODEC support via Xvid 1.1 CODEC package, a MPEG-4
    compliant video codec - (from 6.0.3)

-   BlueZone/Seagull web-to-host control module v3 (3.5.3.601) for FPPS
    (from 3.4.1.480) -- Supports secondary web-to-host FPPS 3270 access
    at the site <https://nbcbz.nbc.gov/bluezone/faa>

-   SMS 2003 Advanced Client SP2 (from SP1)

-   Registry permissions changes to support end-user configuration of
    Dell Touch Pad settings

-   Folder permission changes to prevent FRAC Sprint dialer DUN error

-   Disable the InstallShield Update Service Update Manager and
    Scheduler on the Dell D620 & GX-620

-   Updated the branding to reflect "AVS Standard Client 2.1"

-   One-time enabling of the OfficeScan firewall settings "Enable
    Intrusion Detection Systems (IDS)" and "Enable Alert Message"

-   Verify and re-install the approved SPAS ActiveX controls if missing
    (SC 2.1 Update only)

-   Verify and re-install the Lotus Sametime Meeting Center ActiveX
    control if missing (SC 2.1 Update only)

-   Enhanced "Standard Client Tools" utility v. 1.43 with new functions
    (Change time zone, defrag, manage ODBC system DSNs, DHCP renew)

# January 19, 2007 - January 2007 Security Updates

-   MS07-002 -- Vulnerabilities in Microsoft Excel Could Allow Remote
    Code Execution (927198) -- KB925257

-   MS07-003 - Vulnerabilities in Microsoft Outlook Could Allow Remote
    Code Execution (925938) - KB924085

-   MS07-004 - Vulnerability in Vector Markup Language Could Allow
    Remote Code Execution (929969)

# February 23, 2007 - February 2007 Security Updates

-   MS07-006 - Vulnerability in Windows Shell Could Allow Elevation of
    Privilege (928255)

-   MS07-007 - Vulnerability in Windows Image Acquisition Service Could
    Allow Elevation of Privilege (927802)

-   MS07-008 - Vulnerability in HTML Help ActiveX Control Could Allow
    Remote Code Execution (928843)

-   MS07-009 - Vulnerability in Microsoft Data Access Components Could
    Allow Remote Code Execution (927779)

-   MS07-011 - Vulnerability in Microsoft OLE Dialog Could Allow Remote
    Code Execution (926436)

-   MS07-012 - Vulnerability in Microsoft MFC Could Allow Remote Code
    Execution (924667)

-   MS07-013 - Vulnerability in Microsoft RichEdit Could Allow Remote
    Code Execution (918118) - Security Update for Windows XP (KB918118)
    & Security Update for Office 2003 (KB920813)

-   MS07-014 - Vulnerabilities in Microsoft Word Could Allow Remote Code
    Execution (929434) - (KB929057) -- **Conflicts with OPSS**

-   MS07-015 - Vulnerabilities in Microsoft Office Could Allow Remote
    Code Execution (932554) - (KB929064)

-   MS07-016 - Cumulative Security Update for Internet Explorer (928090)

# March 6, 2007 -- February 2007 Windows XP Cumulative Daylight Savings Time Update

-   2007 Daylight Savings Time (DST) Update for Windows XP (KB931836)

# April 3, 2007 -- Lotus Sametime Installer for Secure Desktops 6.5.1 Fix Pack 1 (Supports NexGen Sametime Meeting Center services)

-   Lotus Sametime Installer for Secure Desktops (SISD) for Sametime
    Meeting Center 6.5.1 Fix Pack 1 (JNILoader Control v. 6,5,1,119)

# April 13, 2007 -- MS07-017 Security Update (expedited due to exploitation)

-   MS07-017 - Vulnerabilities in GDI Could Allow Remote Code Execution
    (925902)

# April 19, 2007 - April 2007 Security Updates

-   MS07-019 -- Vulnerability in Universal Plug and Play Could Allow
    Remote Code Execution (931261)

-   MS07-020 - Vulnerability in Microsoft Agent Could Allow Remote Code
    Execution (932168)

-   MS07-021 - Vulnerabilities in CSRSS Could Allow Remote Code
    Execution (930178)

-   MS07-022 - Vulnerability in Windows Kernel Could Allow Elevation of
    Privilege (931784)

# April 30, 2007 -- Microsoft Office 2007 Compatibility Pack

-   Microsoft Office 2007 Compatibility Pack to enable Office 2003 to
    open, edit and save documents created in Office 2007.

# May 17, 2007 - May 2007 Security Updates

-   MS06-033 Vulnerability in ASP.NET 2.0 Could Allow Information
    Disclosure (917283)

-   MS06-056 Vulnerability in ASP.NET 2.0 Could Allow Information
    Disclosure (922770)

-   MS07-023 Vulnerabilities in Microsoft Excel Could Allow Remote Code
    Execution (934233) -- KB933666 for Office 2003 and KB933688 for
    Office 2007 Compatibility Pack

-   MS07-024 Vulnerabilities in Microsoft Word Could Allow Remote Code
    Execution (934232)

-   MS07-025 Vulnerability in Microsoft Office Could Allow Remote Code
    Execution (934873) -- KB934180 for Office 2003 and KB934062 for
    Office 2007 Compatibility Pack

-   MS07-027 Cumulative Security Update for Internet Explorer (931768)

# June 20, 2007 - June 2007 Security Updates

-   MS07-031 - Vulnerability in the Windows Schannel Security Package
    Could Allow Remote Code Execution (935840)

-   MS07-033 - Cumulative Security Update for Internet
    Explorer (933566) - Replaced MS07-027

-   MS07-034 - Cumulative Security Update for Outlook Express for
    Windows XP (KB929123) -- Replaced MS06-016 (KB911567), MS06-043
    (KB920214) , MS06-076 (KB923694)

-   MS07-035 - Vulnerability in Win 32 API Could Allow Remote Code
    Execution (935839) -- Replaced MS06-051 (KB917422)

# July 19, 2007 - July 2007 Security Updates

-   MS07-036 - Vulnerabilities in Microsoft Excel Could Allow Remote
    Code Execution (936542) - KB936507 (Excel -Office 2003) and KB936514
    (Excel - Office 2007 Compatibility Pack)

-   MS07-040 - Vulnerabilities in .NET Framework Could Allow Remote Code
    Execution (931212) - KB928365 (.NET Framework 2.0) and KB928366
    (.NET Framework 1.1 SP1)

# August 8, 2007 -- Adobe Flash Player 9.0.47.0

-   Upgrade of the Adobe Flash Player to version 9.0.47.0 to address
    security vulnerabilities and support an upcoming Form 337 release.

# August 25, 2007 - August 2007 Security Updates

-   MS07-042 - Vulnerability in Microsoft XML Core Services Could Allow
    Remote Code Execution (936227)

    -   Security Update for Microsoft XML Core Services 4.0 Service Pack
        2 (KB936181) Replaces MS06-071

    -   Security Update for Windows XP (KB936021) Replaces MS06-061
        (KB924191)

    -   Security Update for the 2007 Microsoft Office System (KB936960)

    -   Security Update for Office 2003 (KB936048) Replaces MS06-061
        (KB924424)

-   MS07-043 - Vulnerability in OLE Automation Could Allow Remote Code
    Execution (921503)

-   MS07-044 - Vulnerability in Microsoft Excel Could Allow Remote Code
    Execution (940965)

    -   Security Update for Excel 2003 (KB940602) Replaces MS07-036
        (KB936507)

-   MS07-045 - Cumulative Security Update for Internet Explorer (937143)
    Replaces MS07-033

-   MS07-046 - Vulnerability in GDI Could Allow Remote Code Execution
    (KB938829) Replaces MS06-001 (KB912919)

-   MS07-047 - Vulnerabilities in Windows Media Player Could Allow
    Remote Code Execution (KB936782) - Replaces MS06-024 (KB917734)

-   MS07-050 - Vulnerability in Vector Markup Language Could Allow
    Remote Code Execution (938127)

    -   Security Update for Windows XP Service Pack 2 (KB938127)
        Replaces MS07-004 (KB929969)

# October 19, 2007 - October 2007 Security Updates

-   MS07-056 - Security Update for Outlook Express and Windows Mail
    (941202)

-   MS07-057 - Cumulative Security Update for Internet Explorer (939653)
    -- Replaces MS07-045

-   MS07-058 - Vulnerability in RPC Could Allow Denial of Service
    (933729)

-   August 2007 cumulative time zone update for Microsoft Windows
    operating systems (KB933360) -- Replaces KB931836

# November 19, 2007 - November 2007 Security Updates

-   MS07-061 - Vulnerability in Windows URI Handling Could Allow Remote
    Code Execution (943460) -- Replaces MS06-045

# January 8, 2008 - December 2007 Security Updates

-   Windows XP Hotfix 946627, Addresses the issue of IE crashing after
    installation of security update 942615 (MS07-069)

-   MS07-064 - Vulnerabilities in DirectX Could Allow Remote Code
    Execution (941568) -- Replaces MS05-050

-   MS07-065 - Vulnerability in Message Queuing Could Allow Remote Code
    Execution (937894)

-   MS07-067 - Vulnerability in Macrovision Driver Could Allow Local
    Elevation of Privilege (944653)

-   MS07-068 - Vulnerability in Windows Media File Format Could Allow
    Remote Code Execution (941569 and 944275)

-   MS07-069 - Cumulative Security Update for Internet Explorer (942615)
    -- Replaces MS07-057

# January 17, 2008 - January 2008 Security Updates

-   MS08-001 -- Vulnerabilities in Windows TCP/IP Could Allow Remote
    Code Execution (941644)

-   MS08-002 -- Vulnerability in LSASS Could Allow Local Elevation of
    Privilege (943485)

# January 25, 2008 -- SQL 2005 Reporting Services Print Control

-   Upgrade of the SQL 2005 Reporting Services Print ActiveX Control to
    version 2005.90.3042.0 to meet the requirement of several AVS
    National Applications, including Form 337, ATOS 1.2, etc.

# February 20, 2008 -- AVS Standard Client 2.2 Baseline Release/Update

**Description:** A required minor release upgrade to the AVS Standard
Client 2.1 baseline which includes additional and upgraded baseline
applications, components, updates and configuration settings.

**Source for Installation:** AVS Standard Client 2.2 Generic Ghost DVD
or the SMS/Manual SC 2.2 Update package dated February 13, 2008.

**Justification:** Required to enhance the AVS SC baseline functionality
and maintain COTS compatibility and support.

**[New Components:]{.underline}**

-   **vBrick CODEC/Player** -- Provides support for playing FAA live
    video feeds with closed captioning support.

-   **FAAMIS Desktop** Shortcut (for accessing re-hosted "green screen"
    AVS FSAS mainframe applications) -- Operation and functionality are
    very similar to the prior OpenConnect 3270 terminal emulation
    environment.

**[Upgraded Components:]{.underline}**

-   **Adobe Reader 8.1.1** (previously 7.0.5) -- Provides latest support
    for opening Adobe PDF documents and fixes known security
    vulnerabilities.

-   **Apple QuickTime Player 7.3** (from 7.1) -- Provides latest support
    for Quicktime multimedia content and fixes known security
    vulnerabilities.

-   **Sun Java 2 Standard Edition Runtime Environment 6.0 Update** 3
    (from version 5.0 Update 5) -- Provide

-   **v-GO 6.0.04 Client** (from version 5.0.4) -- Fixes a few known
    v-GO client bugs such as the v-GO "end task" message when logging
    off or shutting down a computer.

-   **Winzip Professional 11.1** (from 10.0 Build 6698) -- Provides
    extended support for other compressed file types and fixes known
    security vulnerabilities.

-   **Adobe Shockwave Player 10.2.0.023** (from 10.1.3.018) -- Fixes
    known security vulnerabilities.

-   **SQL 2005 Reporting Services Print Control 2005.90.3042.0** (from
    2005.90.2047.0)

-   **Updated Standard Client Tools (1.46)** that provides a new menu
    option to "Enable or Disable the v-GO Client" as well as an enhanced
    proxy utility for Internet Explorer

-   **Updated critical device drivers** for the supported AVS
    desktop/laptop platforms -- Fixes device performance and/or
    operation issues.

-   **ALL previously CM Approved Microsoft Security Updates for the SC
    2.x baseline** -- Fixes known security vulnerabilities.

**[Configuration Settings/Security Controls]{.underline}**

-   Enable Transport Layer Security TLS for Internet Explorer and Sun
    Java -- New encryption protocol required by many secure web
    sites/applications.

# February 25, 2008 - February 2008 Security Updates

-   MS08-007 - Vulnerability in WebDAV Mini-Redirector Could Allow
    Remote Code Execution (946026) - Security Update for Windows XP
    (KB946026)

-   MS08-008 - Vulnerability in OLE Automation Could Allow Remote Code
    Execution (947890) - Security Update for Windows XP (KB943055) -
    Replaces MS07-043

-   MS08-009 - Vulnerability in Microsoft Word Could Allow Remote Code
    Execution (947077) - Security Update for Microsoft Office Word 2003
    (KB943983) -Replaces MS07-024

-   MS08-010 - Cumulative Security Update for Internet
    Explorer (944533) - Replaces MS07-069

-   MS08-011 - Vulnerabilities in Microsoft Works File Converter Could
    Allow Remote Code Execution (947081) - Security Update for Microsoft
    Works Suite 2005 (KB943973)

-   MS08-012 - Vulnerabilities in Microsoft Office Publisher Could Allow
    Remote Code Execution (947085) - Security Update for Microsoft
    Office Publisher 2003 (KB946254) -- Replaces MS06-054 (KB894542)

-   MS08-013 -- Vulnerability in Microsoft Office Could Allow Remote
    Code Execution (947108) -- Security Update for Microsoft Office 2003
    (KB945185) - Replaces MS06-047

-   Windows XP Hotfix 884018 to prevent corruption of local security
    database (1202 event errors in the Application event log) -
    <http://support.microsoft.com/kb/884018>

-   Windows XP Hotfix 889320 to prevent recurring network browser errors
    in the System event log - <http://support.microsoft.com/kb/889320>

# March 19, 2008 - March 2008 Security Updates

-   MS08-014 - Vulnerabilities in Microsoft Excel Could Allow Remote
    Code Execution (949029) - Security Update for Microsoft Office Excel
    2003 (KB943985) (Replaces MS07-044 - KB940602) and Security Update
    for Microsoft Office Excel 2007 (KB946974) (Replaces MS07-036 -
    KB936514)

-   MS08-015 - Vulnerability in Microsoft Outlook Could Allow Remote
    Code Execution (949031) -- Replaces MS07-003 (KB924085)

-   MS08-016 - Vulnerabilities in Microsoft Office Could Allow Remote
    Code Execution (949030) -- Replaces MS07-025 (KB934180)

-   Windows XP Hotfix KB935843 to prevent BSOD when printing with
    certain printer drivers or some PCL printing with the SQL Reporting
    Services print control (root cause is MS07-017 - KB925902) -
    http://support.microsoft.com/kb/935843

# April 21, 2008 - April 2008 Security Updates

-   MS08-018 -- Vulnerability in Microsoft Project Could Allow Remote
    Code Execution (950183) -- Install only if Project 2003 is present.

-   MS08-019 -- Vulnerabilities in Microsoft Visio Could Allow Remote
    Code Execution (949032) -- Replaces MS07-030 (KB931281) - Install
    only if Visio 2003 is present.

-   MS08-020 -- Vulnerability in DNS Client Could Allow Spoofing
    (945553)

-   MS08-021 -- Vulnerabilities in GDI Could Allow Remote Code
    Execution (948590) -- Replaces MS07-046 (KB938829)

-   MS08-022 -- Vulnerability in VBScript and JScript Scripting Engines
    Could Allow Remote Code Execution (944338) -- Replaces MS06-023
    (KB917344)

-   MS08-023 - Security Update of ActiveX Kill Bits (948881)

-   MS08-024 - Cumulative Security Update for Internet Explorer (947864)
    -- Replaces MS08-010 (944533)

-   MS08-025 -- Vulnerability in Windows Kernel Could Allow Elevation of
    Privilege (941693)

# May 23, 2008 - May 2008 Security Updates

-   MS08-026 -- Critical Vulnerabilities in Microsoft Word Could Allow
    Remote Code Execution (951207) - Security Update for Microsoft
    Office Word 2003 (KB950241) & Security Update for Microsoft Office
    system 2007 (KB951808) \-- Replaces MS08-009, KB943983 (Office 2003)

-   MS08-027 -- Critical Vulnerability in Microsoft Publisher Could
    Allow Remote Code Execution (951208) Replaces MS08-012, KB946254

-   MS08-028 -- Vulnerability in Microsoft Jet Database Engine Could
    Allow Remote Code Execution (950749)

-   Windows XP Hotfix KB922410 - Prevent random BSOD when a computer is
    starting up and the Winlogon.exe process crashes -
    <http://support.microsoft.com/kb/922410>