Windows Update applied wrong version of MS02-071

From: Bingham, Robert (rbingham@EDS.COM)
Date: 03/20/03

  • Next message: The Dark Tangent: "DEF CON Announcement: CFP, Media now on line!" 
    Date:         Thu, 20 Mar 2003 14:42:28 -0600
From: "Bingham, Robert" <rbingham@EDS.COM>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    As a heads up, two of us used Windows Update to patch about 30 NT 4.0
    servers on Feb 15,2003. Every one of those servers received MS02-071 on
    that date and all received the wrong version. Microsoft pulled that patch
    on Feb 3 and issued the revised patch on Feb 10. I checked, and Windows
    Update applies the correct version today. I don't know when this was fixed,
    but as of 2/15 it was still patching with the file win32k.sys that has a
    version of 4.0.1381.7198 and a date of 10/09/2002. The revised file is
    dated 01/30/03. Its version comes up as 4.0.1381.7207 on most machines, but
    I have seen one instance in which it is displayed simply as 4.00.

    Thanks,
    Robert Bingham

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    Delivery co-sponsored by TruSecure Corporation
    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    TICSA - Anniversary Special - Limited Time

    Become TICSA certified for just $221.25 US when you register before 3/31/03
    with PROMO "TS0103" at www.2test.com. NO membership fees, certification
    good for 2 years. Price for international delivery just $296.25 US, with
    this offer. Offer cannot be combined with any other special and expires
    3/31/03. Visit www.trusecure.com/ticsa for full details.

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

  • Next message: The Dark Tangent: "DEF CON Announcement: CFP, Media now on line!"

    Relevant Pages

    • Re: Bug in IE critical patch?
      ... The patch is important for your security, ... > I may have left Norton running while installing the patch. ... >> Did you "download" the patch via Windows Update? ...
      (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
    • Re: 891711/MS05-002 Updated (fixed) for Win9x
      ... I am still confused as to whether it is better to | just update and overwrite the old patch through Windows Update or is it much | safer and or better to remove the original patch and update to the new one | through Windows Update. ... |> current form, is a more or less a permanent solution, with the update |> still running as a background process? ... security |> update ...
      (microsoft.public.security)
    • [Full-Disclosure] OT but related.
      ... Windows Update doesn't check files, ... "For the rest of you, testing has shown that some patch management ... Update Expert will incorrectly assert ... they will correctly report the patch level. ...
      (Full-Disclosure)
    • RE: Print Current Record Only
      ... >> Microsoft Access Support ... >> to visit Windows Update at ... >> the patch. ...
      (microsoft.public.access.gettingstarted)
    • RE: Windows XP with SP2 installed, no access to updates.
      ... Thank you Jeff for the trouble that you have taken. ... > which a patch was applied. ... > caution (download even ones you're not sure are SP2-only), ... Now go to microsoft.com and the Windows Update site, ...
      (microsoft.public.windowsupdate)