Windows patch backfires on the security-minded

CNet ^ | 17 October 2005 | Joris Evers

[ShadowAce]

Security-conscious Windows users who tweaked the operating system to protect their PCs better are getting hit hardest by a flawed Microsoft patch, experts said Monday.

Microsoft has acknowledged that a patch released last week can cause trouble for some users. It could lock them out of their PC, prevent the Windows Firewall from starting, block certain applicationsfrom running or installing, and empty the network connections folder,among other things, the software maker said in an advisory on Friday.

The trouble occurs when default permission settings on a Windows folder have been changed, according to Microsoft. Those changes aren't common, but have been applied by some people to add extra security to their systems, experts said.

"The flaw in the patch affects users who tightened down access lists," said Johannes Ullrich, the chief research officer at the SANS Institute. "These are typically more-advanced, security-conscious users."

The settings are also likely to be used by businesses with strict access requirements, such as those in the financial services or health care industries, said Vijay Adusumilli, a senior product manager at security software vendor St. Bernard Software. "They tighten settings for security purposes," he said.

The patch was released on Tuesday to fix four Windows vulnerabilities. Microsoft tagged the combined vulnerabilities "critical," and experts warned that a worm attack linked to the issue could be imminent. The software maker urged all users to immediately apply the update, delivered in security bulletin MS05-051.

"If users made changes to their security settings and tightened them, this patch is going to break a whole lot of software," Adusumilli said. The update simply didn't take into account all the possible Windows user configurations, he said.

The problem may result in more apprehension among users when it comes to applying Windows patches, he noted. "Microsoft's patch quality reputation just started to improve, but I think this is going to dent that a bit," Adusumilli said.

That is worrying, especially with a narrowing amount of time between the release of a software fix and a malicious code attack that exploits the vulnerability related to it, Ullrich said. The narrowing "patch window" has moved people to apply remedies faster.

"Many companies have come to rely on high patch quality to use accelerated deployment procedures for critical patches. But the problems with MS05-051 will make people think twice next time around," Ullrich said.

The flawed update delivered "two strikes against good security," Ullrich said. "First, you get penalized for running an enhanced security template. Next, you get penalized for patching quickly."

Microsoft had no immediate comment for this story.

[ShadowAce]

[ShadowAce]

BTW--thanks to N3WBI3 for the link.

[frogjerk]

[martin_fierro]

[AgentEcho]

This happened on many of our systems. Explorer wouldn't run, using Task manager to try to run a new task was SSSLLLOOOOWWWWWWW... We found the problem to be in the Bypass Traverse Checking in the Group Policy. It was set to Administrators only. The default is Administrators, Backup Operators, Power Users, Users, Everyone per Microsoft. Here's how we fixed our problem with Win2K, but to fix XP is very similar:

Go to Start>Run.
Type in MMC and select OK.
A window titled Console1 will appear with a daughter window titled Console Root inside.
In the Console 1 window click File and select Add / Remove Snap-in
The Add / Remove Snap-in window will appear.
Click Add at the bottom left of the window
The Add Standalone Snap-in window will appear.
Scroll down and highlight Group Policy and click Add at the bottom of the screen.
The Select Group Policy Object window will appear.
Make no changes, just select Finish
Close the Add Standalone Snap-in window
Select OK at the Add/Remove Stand-in window.
Users may notice that instead of Group Policy, Local Computer Policy appears now. This is normal.
The Console Root window now contains the Local Computer Policy with a + next to it.
Follow the path below.

Console Root>
Local Computer Policy>
Computer Configuration>
Windows Settings>
Security Settings>
Local Policies>
User Rights Assignment

Once User Rights Assignment is highlighted then on the right hand side of the window double-click Bypass traverse checking.
The Local Security Policy Setting windows will open. Click Add at the bottom of the window.
The Select Users or Groups window appears.
Highlight the Everyone group at the top pain of the window.
Click the Add button in the middle of the screen.
The Everyone account moves to the bottom pain of the screen.
Click Ok at the bottom of the window
You will now return to the Local Security Policy Setting window.
The Everyone group is now listed in the window.
There should be a check in the box next to Everyone under the Local Policy Setting header.
If not, check it and click Ok.
Exit the Console1 window.
If asked to save the settings of Console1 answer no.

Hope this helps
Æ

[RedBloodedAmerican]

So it seems the problem is with the download being filtered, and not with the patch itself?

[RedBloodedAmerican]

What made the change? Mine is fine.

[Paulus Invictus]

MAC is the answer. Mine never, but never has had a problem and I have had four MACs (upgrades) in 12 years. All PC owners must have a permanent link to Kim Kommando just to keep their PS up and running and even then Gates and company can and do screw it all up. Flame away!

[rdb3]

Microsoft has acknowledged that a patch released last week can cause trouble for some users. It could lock them out of their PC, prevent the Windows Firewall from starting, block certain applicationsfrom running or installing, and empty the network connections folder,among other things, the software maker said in an advisory on Friday.

If you want a Google GMail account, FReepmail me.
Also, please see The Backside of American History
You'll love this 187 page .pdf (1.99 MB)

[MarkL]

Unfortunatly, this demonstrates one of the most overlooked requirements of any computer security, and it DOES NOT MATTER WHAT SYSTEMS YOU'RE DEALING WITH!

You NEVER, NEVER, apply any patch to a production system, without first having tested it on your identical system in the test lab!

What? You don't have a test lab? Well, set one up! And be sure that you've got identical hardware in there, since patches can interact differently with different drivers.

It's an ugly situation, and it's only going to get worse.

Mark

[DManA]

The firewall thing has effected me. Lot of other odd things happening too. To complicate matters, the system log is starting to show disk errors. Hard disk problems? MS patch problems? Both? Damn.

[Capn TrVth]

'Microsoft had no immediate comment for this story'

You'll probably see fewer hackey-sacks on the M-Soft Campus for a few weeks ;>

[DManA]

That is EXACTLY what's happening with my system. Thanks so much, I'll try this.

This happened on many of our systems. Explorer wouldn't run, using Task manager to try to run a new task was SSSLLLOOOOWWWWWWW...

[antiRepublicrat]

MAC is the answer.

Nobody's perfect. Apple has had some problems with their updates/upgrades. Remember the erasing hard drives?

Of course, this problem wouldn't have occurred if you didn't need to do massive tweaking to properly secure a Windows box.

[ShadowAce]

Great! Thanks for posting the solution. Since I don't personally run WIndows, I had no idea what the fix was.

[antiRepublicrat]

You NEVER, NEVER, apply any patch to a production system, without first having tested it on your identical system in the test lab!

We used to do this even for the thousands of clients under our umbrella. We had a pretty strict, locked-down baseline, and we tested all patches before approving them for release. The lab was pretty big, with a reasonable sampling of the hardware and software that was out there.

A few times the testing caught Microsoft opening up ports that we had closed and enabling services that we had disabled for security reasons. That was scary.

[LexBaird]

Yeah, sure. Every small business has the time and money to set up a test lab for their computer systems. Why, our 20 person shop has an empty office just waiting for a full time IT guy to manage our Windows updates for us.

[chilepepper]

amen. take the least important machine you can and patch, and test it like crazy. then a medium important machine with a full and easy to access backup, and test like crazy. when you are SURE that no mission critical stuff will break, then you patch your important equipment.

some stuff is *SO* mission critical that it is vorbotten to patch or touch the working system! if it needs protection, the protection comes from outboard appliances like active intrusion detectors or firewalls...

[AgentEcho]

RBA - You probably have administrative rights so the problem doesn't appear. Or you're lucky. Not all of out 2000 systems had the problem.

DManA - I forgot the first step. Log in with an administrator account.