Re: Windows XP Update possible BUG [ Was: RE: RE: MS01-058 patch ]

From: Ken.Williams@ey.com
Date: 12/20/01 

To: focus-ms@securityfocus.com
From: Ken.Williams@ey.com
Date: Thu, 20 Dec 2001 15:57:21 -0600

I have had problems with the MS01-058 patch, when applied to boxes
with Win XP Pro (5.1.2600) using IE 6.0.2600 with Updates Q306121;
Q312461 already installed. After applying Q313675, IE 6.0, which
had previously been very stable and reliable, started to freeze and/or
crash regularly (2-10 times/hour during typical web surfing activity).
No other changes were made to the system, to IE config, or to web
surfing activity. All of the IE application errors point to issues
with kernel32.dll and wininet.dll. I'll do more research when I have
time.

I have also had issues with the v4.windowsupdate.microsoft.com site
since 10/25/01 (when I started using it). I have had a couple of
tickets open with MS for these issues, and some of them have been
partially resolved. Issues I have had:

1) Cannot scan my systems for updates and/or install the software to
scan (same problem that you mention below, Jorge)

2) Reports failed installation of patches that my system correctly
reports as being successfully installed.

3) WindowsUpdate lists critical patches that need to be installed,
after scanning my system, when those patches have already been
installed.

4) WindowsUpdate lists drivers that need to be updated, when those
drivers have in fact already been installed via download from OEM
vendor site rather than from WindowsUpdate site.

Since opening tickets with MS for these issues, #1 has been corrected,
#2 has been partially resolved, #3 was resolved but seems to have
reappeared, and #4 is a new bug that has not been reported to MS
yet.

During discussions with MS, they mentioned that several new versions
of the WindowsUpdate site have been rolled out recently - last
windowsupdate code rollout they mentioned to me was on 12/05/01, but
I'm sure there have been code rollouts since then. MS has generally
been extremely responsive and helpful when reporting issues with the
WindowsUpdate site - and that is a Good Thing[tm] since they have
integrated security patch access and rollout so well into Windows XP.
In fact, if the WindowsUpdate site breaks, then Windows XP users are
forced to wade through the microsoft.com/security site and find
patches the way we used to do it back in the NT 4.0 days.

Bottom line though is that the WindowsUpdate site is not quite ready
for the primetime status that Windows XP features and functionality
have relegated to the site. My advice is that you should not rely
on the WindowsUpdate site yet for your security patches. Use
microsoft.com/security instead. Remember also that most security
patches show up on the Windowsupdate site days (weeks??) after they
hit security mailing lists and the microsoft.com/security site - and
a few days is all the script kiddies need to exploit your new
Microsoft vulnerabilities.

Regards,
ken

Ken Williams ; Technical Lead ; ken.williams@ey.com
eSecurityOnline - an eSecurity Venture of Ernst & Young
ken.williams@ey.com ; www.esecurityonline.com ; 1-877-eSecurity

                    "Jorge Roxo"
                    <j.roxo@sotag To: "'Mikael Lindqvist GBG'"
<mlindqvist@meridium.se>
                    us.pt> cc:
<focus-ms@securityfocus.com>, (bcc: Ken Williams/AABS/EYLLP/US)
                                         Subject: Windows XP Update
possible BUG [ Was: RE: RE: MS01-058 patch ]
                    12/20/2001
                    01:07 PM

Hum, ... we installed the MS01-058 patch on Windows XP IE 6.0
Workstatons and our Win .Net test box, and so far so good. No problems
there at all. Maybe a badly downloaded installer file?. Hum possible..
Also, here's a question.. Anyone experiencing problems when tryin to
access v4.windows.update.microsoft.com ? It suppossed to work.. But for
us it reports it cannot install the software needed to check if we need
upgrades in our software. This is been tested on XP Workstations,
American/US using Portuguese language setup, with Office XP Professional
Enterprise.

We reported by email this problem to MS, but got no reply at all from
them. The KB article the site points to as a probable cause ( very
restrictive IE security settings ) is of course useless since the
security setup is the WinXP install default. This has reproduced itself
when installing a new box from scratch ( straight into XP, no previous
software installed ). We try to perform the "updated" install option -
meaning it connects to internet and goes to get the files from MS
windows update site - and still same problem.. No connection to the
site. We have tried it having installed both a modem ( Xp compat ) and
lan access to internet too ( lan card XP compat too ) to no avail it
still reports that it cannot do it. Btw also the Active X Control window
that supposedly should appear, does appear but not all the time.. I'd
say it pops up 1 out every 10 tries.

Anyone else got this or a similar problem running XP?

Jorge Roxo,
TCSA/Sotagus Computer Systems Administrator.
j.roxo@sotagus.pt
--------------------------------------------
This e-mail is confidential and privileged. If you are not the intended
recipient please accept our apologies. Do not disclose, copy or
distribute information in this e-mail or take any action in reliance to
its contents, to do so is strictly prohibited and may be unlawful.
Please inform us that this message has gone astray before deleting it.
Thank you for your co-operation.
--------------------------------------------

-----Mensagem original-----
De: Mikael Lindqvist GBG
Enviada: quinta-feira, 20 de Dezembro de 2001 15:59
Para: 'focus-ms@securityfocus.com'
Assunto: RE: MS01-058 patch

No real problems except that it wont install on a couple of computers
running W2k SP2, IE6 (from windowsupdate), SQL2000 and .NET Framework.

It only says that IE6 is not installed, but it is.

Microsoft are involved with this issue, and hopefully they'll straighten
things out.

/Mikael

-----Original Message-----
From: Apolonio, Larry A
Sent: den 18 december 2001 18:32
To: 'focus-ms@securityfocus.com'
Subject: MS01-058 patch

Hello,

Did any have any problems installing the patch? Several people reported
to me that it lock up their keyboard and mouse.

Larry

______________________________________________________________________
The information contained in this message may be privileged and
confidential and protected from disclosure. If the reader of this message
is not the intended recipient, or an employee or agent responsible for
delivering this message to the intended recipient, you are hereby notified
that any dissemination, distribution or copying of this communication is
strictly prohibited. If you have received this communication in error,
please notify us immediately by replying to the message and deleting it
from your computer. Thank you. Ernst & Young LLP

Relevant Pages

  • Re: <+> Patch for MS04-007 Today!!!!<+>
    ... > vulnerability which Microsoft acknowledged by releasing this patch. ... > that method of update and install all currently offered "Critical Updates ... > access and is periodically being updated at WindowsUpdate. ... > if you need to take any action to protect it, or if they will act on your ...
    (microsoft.public.backoffice.smallbiz)
  • Re: <+> Patch for MS04-007 Today!!!!<+>
    ... > vulnerability which Microsoft acknowledged by releasing this patch. ... > that method of update and install all currently offered "Critical Updates ... > access and is periodically being updated at WindowsUpdate. ... > if you need to take any action to protect it, or if they will act on your ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: <+> Patch for MS04-007 Today!!!!<+>
    ... > vulnerability which Microsoft acknowledged by releasing this patch. ... > that method of update and install all currently offered "Critical Updates ... > access and is periodically being updated at WindowsUpdate. ... > if you need to take any action to protect it, or if they will act on your ...
    (microsoft.public.windows.server.sbs)
  • <+> Patch for MS04-007 Today!!!!<+>
    ... vulnerability which Microsoft acknowledged by releasing this patch. ... that method of update and install all currently offered "Critical Updates ... access and is periodically being updated at WindowsUpdate. ... if you need to take any action to protect it, or if they will act on your ...
    (microsoft.public.backoffice.smallbiz)
  • <+> Patch for MS04-007 Today!!!!<+>
    ... vulnerability which Microsoft acknowledged by releasing this patch. ... that method of update and install all currently offered "Critical Updates ... access and is periodically being updated at WindowsUpdate. ... if you need to take any action to protect it, or if they will act on your ...
    (microsoft.public.backoffice.smallbiz2000)