SANS ISC: Microsoft Update Advisory for February 2015

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

A good TechNet article explaining MS15-011 and MS15-014:

http://blogs.technet.com/b/srd/archive/2015/02/10/ms15-011-amp-ms15-014-hardening-group-policy.aspx

KB3001652 Visual Studio 2010 Tools patch from today's 'Patch Tuesday' set is not installing.

It hangs up the computer and cannot be stopped by choosing 'cancel'; WIndows 7 x64 and likely Win 8 according to various other reports.


You can find the active svchost.exe and kill it to regain control.


If a user tries to 'reboot' out of the hung install, they will get stuck at logoff; requiring a 'power cycle' ungraceful shutdown.


Microsoft, PLEASE PULL THIS PATCH!

Quoting AnAdmin:KB3001652 Visual Studio 2010 Tools patch from today's 'Patch Tuesday' set is not installing.
...

KB3001652 is from October 2014:

https://support.microsoft.com/kb/3001652

It might have been 'published' in October but until about 30 minutes ago, it was being pushed out with this AM's updates and hanging up machines.

MS has pulled KB3001652 from current Windows Update.

KB3034196 for IE11 appeared after KB3001652 was pulled by MS.


-------------
Links to others reporting this AM's 'horror':
-------------

http://stackoverflow.com/questions/9188447/visual-studio-2010-service-pack-1-is-not-installing

http://forums.overclockers.co.uk/showthread.php?p=27612025

http://www.eightforums.com/installation-setup/61425-update-failure-kb3001652.html

http://boards.4chan.org/g/thread/46506369

Odd. KB 3001652 does not appear on the current WU/WSUS release list, https://support2.microsoft.com/kb/894199/en-us

If it is from October why did it wait to install until today on my fully patched 7 & 8.1 machines?

It does this on both Windows 7 and 8.1 machines. The 8.1 machine tried to continue the install when it was shut down normally and had to be powered down the hard way. It took longer to reboot. When the 7 machine was rebooted normally it immediately restarted the installation again during the reboot process.

Quoting AnAdmin:KB3001652 Visual Studio 2010 Tools patch from today's 'Patch Tuesday' set is not installing.

It hangs up the computer and cannot be stopped by choosing 'cancel'; WIndows 7 x64 and likely Win 8 according to various other reports.


You can find the active svchost.exe and kill it to regain control.


If a user tries to 'reboot' out of the hung install, they will get stuck at logoff; requiring a 'power cycle' ungraceful shutdown.


Microsoft, PLEASE PULL THIS PATCH!

Same here on Win7/64bit... waited for an hour for this patch to install. during reboot of the hung install it got stuck on "Configuring Windows updates 30% complete Do not turn off your computer."

Hey guys, MS15-011 lists Server 2003 as affected, but no patch due to the magnitude of changes required. Since WinXP is so similar, I'm guessing that Windows XP is affected as well. My current employer has a bunch of XP laptops and we pay royally for support. I've asked our MSFT rep to find out of there's going to be a WinXP patch. There's no answer yet. Has anyone else heard?

As far as mitigating controls, I'm thinking that we only allow use of those laptops at our own facilities; no use on hostile networks (coffee shops, bakeries, fast food joints, hotels, etc).

What are other people doing?

MJ

After installing all but one patch -- the one patch I "hid" had something to do with whether I would be upgrading to Windows 8 or something like that; it was unchecked by default -- I rebooted a Windows Vista Home Premium PC. I panicked when I loaded Mathematica (which is running 24/7 on this PC, and is used very heavily, and is part of the normal post-reboot sequence) and the fonts were goofed up. All text in any Mathematica notebook looked like grayed-out text in a disabled Windows control. All the text and graphics in the whole screen looked like that. I tried looking around for relevant support options -- found none. I started browsing "just what was fixed" in the Windows Update -- nothing that jumped out. So I did a System Restore. That fixed the problem! Now, I realize I probably should have at least tried rebooting first. But like I said, I was panicking. Next time (if) I'll try a reboot, but I have to wonder why that would "fix" this problem: what happened on the first reboot?

Now 16 updates are available to install. Frankly, I don't know what to install. I already know to steer clear of the C++ update, at least for now. I'll muddle through this somewhere along the line. The last thing I want to do is lose the use of Mathematica! What if I do an install and System Restore doesn't fix it?

See also post below.

Microsoft update KB3013455 part of Security bulletin MS15-10 is causing font rendering issues on Server 2003 SP2.

See attached screenshot for a comparison: http://snag.gy/263Zf.jpg

Thanks, anon. That screenshot could describe what I was seeing (NOTE: what I actually saw seemed a little worse, but I was panicking, used to seeing beautifully crisp text and graphics). I've now installed all recommended Windows Update changes EXCEPT for the one you pointed out ("Microsoft update KB3013455 part of Security bulletin MS15-10 is causing font rendering issues on Server 2003 SP2"), and I am happy to report Mathematica is still rendering fonts properly. Notice mine was a Windows Vista Home Premium system. I currently have this Windows Update change "hidden." I did install the C++ run-time update, since it didn't seem to be a problem on my PC.

FYI: Just heard from our Microsoft representative. He is still confirming this, but it looks like Microsoft /will not/ be publishing a patch for WinXP for MS15-011, even for those people that are paying for support. This is not yet final.

In case this is related - it probably is - I had a critical update downloaded (Windows 7), despite having updates turned off, which blocked many of my gaming exe files including for games I was developing. It even deleted the desktop icons of some of the files. Unfortunately my last restore point seems of no use, probably because the update had been downloaded before February but activated after my February 1st last restore point date.

This update was critical enough for me as it made that computer next to useless, since I practically only used it for gaming. Please Microsoft do not do that!