Hotfixes overwritten?

From: Greene, Michael (MGreene@lrs.com)
Date: 05/17/02 

From: "Greene, Michael" <MGreene@lrs.com>
To: focus-ms@securityfocus.com
Date: Fri, 17 May 2002 09:05:31 -0500

Microsoft has published information about slip-streaming service packs into
CD images. This is normally done by expanding the service pack files and
overwriting the respective contents of the i386 directory. The intentions
here are to prevent changed files from being overwritten on the hard drive
when the operating system requests the CD. For instance, if an
administrator needed to add a Windows 2000 component such as DNS, the CD
would now be up to date so that the service pack would not have to be
reapplied after installation. It is a well-known concept (or it should be)
that if you make changes to the operating system files without using a
slip-streamed CD, you should reapply service packs to prevent known issues.

So what about security hotfixes? There is apparently no way to take this
kind of action when applying the Post Service Pack 2 Security Roll-up. Nor
is there any way to slipstream the "critical updates" Microsoft so
frequently releases. So, when a new service is installed from the CD, are
the security hotfixes overwritten?

There IS an article on the Microsoft web site that explains how to chain the
hotfixes to the installation point so they are applied after installation.
Please, don't confuse this with slip-streaming the files directly into the
cd.

Neither hfnetchk, MBSA, or Windows Update do a full check of the files or
registry keys changed by hotfixes, so the reports of these scanners are
insufficient to report when a server has become vulnerable because of an
overwritten hotfix. So the only logical conclusion is that anytime a new
service is installed, the only way to insure the security of the data on the
machine (speaking strictly in terms of operating system flaws) is to
uninstall every hotfix and reapply them. Granted, this should not be an all
day task using Qchain to apply regression tested hotfixes from a network
installation point.

But my question is, why on earth would Microsoft include the ability to
slipstream service packs but not security hotfixes?

____________________________
Michael Greene
Levi, Ray and Shoup, Inc.
IT Solutions - Security Team
(217)793-3800 x1253

Relevant Pages

  • Re: Hot Fixes
    ... Hotfixes are different from service packs in that they are only recommended ... microsoft customer) and they are not tested to the same level as a service ... of this Microsoft does not recommend installing them except to correct a ...
    (microsoft.public.project)
  • Re: A2007 - hotfixes installed? how can i check that?
    ... I typically recommend that you are current with Microsoft ... service packs typically include a roll-up of all prior hotfixes. ...
    (microsoft.public.access.forms)
  • RE: Configure Remote Access Post SBS 2K3 SP1
    ... I was very anal about these Service Packs and downloaded each piece like it ... I did install all of the pieces - step by step according to the instructions ... for Microsoft SBS 2003 Standard. ... As I know, before installing the SBS 2003 SP1 onto the server, we need to ...
    (microsoft.public.windows.server.sbs)
  • Re: Windows Is Now More Secure Than Linux
    ... >to install service packs from a cd or from a central location anymore. ... Obviously someone forgot to tell, erm, Microsoft. ... "Download SP3 Network Installation": ...
    (comp.security.misc)
  • Re: Differing versions of Home and Student Office 2007
    ... Tech Editor for "Microsoft Publisher 2007 For Dummies" ... installation. ... You can download the Service Packs from Windows/Microsoft Update. ...
    (microsoft.public.officeupdate)