Out-of-Band Release to Address Microsoft Security Advisory 2963983

[Brink]

At approximately 10 a.m. PDT, we will release an out-of-band security update to address the issue affecting Internet Explorer (IE) that was first discussed in Security Advisory 2963983. This update is fully tested and ready for release for all affected versions of the browser.

The majority of customers have automatic updates enabled and will not need to take any action because protections will be downloaded and installed automatically. If you’re unsure if you have automatic updates, or you haven’t enabled Automatic Update, now is the time.

For those manually updating, we strongly encourage you to apply this update as quickly as possible following the directions in the released security bulletin.

We have made the decision to issue a security update for Windows XP users. Windows XP is no longer supported by Microsoft, and we continue to encourage customers to migrate to a modern operating system, such as Windows 7 or 8.1. Additionally, customers are encouraged to upgrade to the latest version of Internet Explorer, IE 11.

Please join us tomorrow at 11 a.m. PDT for a webcast where we will present information on the bulletin.

Registration information:

Date: Friday, May 2, 2014
Time: 11:00 a.m. PDT
Registration: https://msevents.microsoft.com/CUI/...-7C-CD-0D-1D-9F-4D-AC-46-22-BC-40-40-E8-D9-93

More information about the upcoming security bulletin can be found at Microsoft’s Advance Notification Service (ANS) webpage. You can also stay apprised of the MSRC team’s recent activities by following us on Twitter at @MSFTSecResponse.

Thank you,
Dustin Childs
Group Manager, Response Communications
Microsoft Trustworthy Computing

Source: Out-of-Band Release to Address Microsoft Security Advisory 2963983 - MSRC - Site Home - TechNet Blogs

 

[Urthboundmisfit]

Thanks Shawn, just updated...no issues.

 

[Lady Fitzgerald]

Thanks for the heads up, Shawn.

 

[NoN]

Yep! Got that security update kb2964358 in Windows Update right now!

Known issues with this security update

• Internet Explorer will crash if you try to install this security update on a Windows 7-based system that does not already have security update 2929437 installed. To avoid this issue, take either of the following actions:
  • Install security update 2929437, and then install security update 2964358. For more information about security update 2929437, click the following article number to view the article in the Microsoft Knowledge Base: 2929437 Description of the security update for Internet Explorer 11 on Windows 7 and Windows Server 2008 R2: April 8, 2014
  • Install security update 2964444 instead of security update 2964358. Security update 2964444 is intended for systems that do not have security update 2929437 installed.

Updating!

 

[Ranger4]

Thanks Shawn. IE 11 update came through this morning & the update went smoothly.

 

[grits]

I'm more than confused! I just forced a Check for Updates 'cuz I didn't have anything new, what I got is KB2964358 & it's NOT checked. I'm still on IE9, is that why I got a different KB#? Evidently all the info from MS in Brinks post deals with IE11. I've thought about upping to IE10 or IE11 but the forum is loaded with posts about problems with both. I'm about to the point of throwing this @#$% machine out the window.

 

[derekimo]

I'm more than confused! I just forced a Check for Updates 'cuz I didn't have anything new, what I got is KB2964358 & it's NOT checked. I'm still on IE9, is that why I got a different KB#? Evidently all the info from MS in Brinks post deals with IE11. I've thought about upping to IE10 or IE11 but the forum is loaded with posts about problems with both. I'm about to the point of throwing this @#$% machine out the window.

That update is for IE6 through IE11, you have to have KB2929437 installed first though.

Description of the security update for Internet Explorer for systems that have security update 2929437 installed: May 1, 2014

Description of the security update for Internet Explorer for systems that have security update 2929437 installed: May 1, 2014

It is a bit confusing with the different KB numbers, but that update applies to you if you have the previously mentioned KB2929437 installed.

 

[andrew129260]

BBC News - Microsoft includes XP users in Internet Explorer fix

 

[Urthboundmisfit]

Critical? Apparently M$ doesn't REALLY think so...

M$ Security Bulletin describes M$14-021 as "Critical" yet in WU result it's left "unchecked" by default.

Huh?

View attachment 316223

 

[andrew129260]

I know, same here it is strange. They might set it to critical in the next few hours.

 

[Urthboundmisfit]

I think I (kinda) know why...

I know, same here it is strange. They might set it to critical in the next few hours.

There were actually 2 updates for IE 11:

Known issues and more information about this security update

The following articles contain more information about this security update as it relates to individual product versions. The articles may contain known issue information. If this is the case, the known issue is listed under each article link.

• 2964444 Description of the security update for Internet Explorer for systems that do not have security update 2929437 installed: May 1, 2014
• 2964358 Description of the security update for Internet Explorer for systems that have security update 2929437 installed: May 1, 2014...

IIRC, April 8th (patch tuesday) also "offered" 2 new IE security updates...

KB2929437 (24.4mb) was "Cumulative" (which I believe superseded previous update/s) and offered optional debugger/ developer tools/ "Enterprise Mode"/ etc... I installed this one.
KB2936068 (15mb) was not listed as cumulative just as "Secrity Update" and did not, I believe supersede previous updates.

Still doesn't explain why M$ in it's "infinite" wisdom leaves this VERY critical patch unchecked by default.

 

[Anak]

That update is for IE6 through IE11, you have to have KB2929437 installed first though.

Description of the security update for Internet Explorer for systems that have security update 2929437 installed: May 1, 2014

Description of the security update for Internet Explorer for systems that have security update 2929437 installed: May 1, 2014

It is a bit confusing with the different KB numbers, but that update applies to you if you have the previously mentioned KB2929437 installed.

This out of band update is more than a bit confusing, especially for the casual user.

As noted by you Derek, 2964358 with the prerequisite of 2929437 is for IE6 through 11. Though, both only make reference to them being necessary for IE11, and 64358 is assuming that 29437 is already installed.

Imagine my thoughts when I have IE10 installed.

Windows Updates should have read my installed updates and offered 29437 when it found it missing, add to that what Urthboundmisfit found; https://support.microsoft.com/kb/2964444. This is only if you have Windows 8.1 as an operating System (OS). You can see the requirement for 8.1 here at the download page: Download details: Security Update for Internet Explorer 11 for Windows 8.1 (KB2964444) - Microsoft Download Centre

For me, this boils down to; Installing 2929437 to find Windows Updates telling me that it is not applicable to my OS.
Next, I installed 2964358 and have spent the time creating this post while using IE10 and have had no crash issues yet, knock on wood.

We should get ready for the onslaught of confused members in the Windows Updates & Activation - Windows 7 Help Forums and Browsers & Mail - Windows 7 Help Forums wondering, What's going on?


For those that need to install 2929437:
Download Cumulative Security Update for Internet Explorer 11 in Windows 7 (KB2929437) from Official Microsoft Download Center

Or 2964444:
Download details: Security Update for Internet Explorer 11 for Windows 8.1 (KB2964444) - Microsoft Download Centre


An adjunct to Andrew's BBC link:

BBC News - Microsoft includes XP users in Internet Explorer fix

We have made the decision to issue a security update for Windows XP users. Windows XP is no longer supported by Microsoft, and we continue to encourage customers to migrate to a modern operating system

Source: Security Update Released to Address Recent Internet Explorer Vulnerability - MSRC - Site Home - TechNet Blogs

But there are other thoughts of wisdom out there about this policy. From Ashraf on dotTech:

Personally speaking, while I’m happy that Microsoft decided to not leave Windows XP users on their own for this bug, I must question Microsoft’s wisdom.

In my mind, either you end Windows XP support or you don’t; either you continue to provide patches, or you don’t. Having one foot in both worlds is not helping anyone.......

Read more at Microsoft releases fix for Internet Explorer security bug... including a patch for Windows XP users | dotTechdotTech

 

[Seffrid]

It's certainly confusing. I have Windows 7 with IE9 (although I use mainly Chrome) and don't have any record in my update history or hidden updates of the pre-requisite 2929437 update, while being offered the new 2964358 update as an unchecked important update. I also don't have any record of the alternative pre-requisite 2964444 update. That's all in relation to the machine I'm using now, I'll check the other one next time I have it on and get offered the new update.

I'll do nothing for now, and watch this space...

EDIT: It looks from the MS forum as if some users are having issues with this new update, and there is also a lot of confusion over the indication that the two alternative pre-requisite updates to be installed before this latest one are stated to be for IE11. IE9 and IE10 users are therefore left wondering what to do.

 

[3Colors]

Seffrid, I'm in the same situation. KB2964358 It is not marked but the update is there in the list(IE9), and one for Windows 7(KB2952664). For less experienced users this is confusing. But as usual, will be a matter of days for the update to be marked.


And I've noticed that after a few weeks now it is marked an update for FrameWork 4.5.1(KB2858725).

 

[UsernameIssues]

Let's look at what some users might do:

1) Do nothing (i.e. wait for the Windows Update process to download/install something). As far as I can tell, these various updates (all for the same issue) are not being pushed just yet to users that do nothing. Users in this category that have IE8 thru IE10 will get IE11. During some future Windows Update process, those IE11 users will get KB2964444.

My guess is that the vast majority of users have not turned on getting updates for things other than Windows. These users are not offered this round of IE updates... but we are not talking about them right now. Edit: I found this hard to believe when I saw it. I tested it several times. Using a setting of getting updates For Windows only did not offer the updates being discussed. But today (04 May), these updates are offered to those with that For Windows only settings.

2) Manually launch Windows Update and install what is offered. For IE11 users, Windows Update will check to see if KB2929437 in installed. In my testing, Windows Update offered me the correct update (KB2964358 or KB2964444). In my testing, Windows Update offered KB2964358 if the user has IE8 thru IE10. It installs just fine and IE did not crash.

3) Research stuff before installing any KB. This is the group that gets in trouble, They can install KB2964358 for IE11 without having KB2929437 installed.


Testing was done via these frozen Virtual Machines:

 

[Seffrid]

3) Research stuff before installing any KB. This is the group that gets in trouble, They can install KB2964358 for IE11 without having KB2929437 installed.

I was with you up to this point, but how anyone who researches stuff will "install KB2964358 for IE11 without having KB2929437 installed" is what I don't get - it's the research that tells them of the need to have the pre-requisite update installed if they have that IE version. The people who may get in trouble are those with other than IE11 who can't work out from the poor information available whether they need KB2964358 or not given that they have neither the pre-requisite updates nor IE11, plus of course those with IE11 who install it without reading the supporting information and without therefore checking whether they have KB2929437 installed (including those on auto-update).

As so often with Windows Updates, we have too little information on which to make a rational decision in this case, while it really ought to be feasible for the Update program to check whether any pre-requisites are installed before offering us the new update.

 

[UsernameIssues]

You are assuming that the people researching the KBs landed on websites with valid info.
Those searching forums/blogs/news articles/e-mail lists/.........
...could go down the wrong path.

I agree that those researchers without IE11 can be confused by the info MS published. I would not want to be a tech writer at MS :-(

 

[Seffrid]

I would not want to be a tech writer at MS :-(

Agreed, but my experience in other walks of life is that those with the technical knowledge are not those with the writing skills, and it's the latter who produce the explanatory notes based on a briefing from the technical guys who can create computer code in a second but can't string two English sentences together in a month of Sundays !

 

[rcanino]

Whoever is responsible for generating so much confusion - and I mean for experienced users who actually do research updates before installing them - should maybe reconsider their choice of profession.

An update is labeled "Important" yet the box is left unchecked by Windows Update ... I knew something was fishy. Windows Update did the right thing - as far as it goes - since I don't have the prerequisite update installed. Unfortunately "as far as it goes" is not even halfway to the fix. I really wish MS would eliminate the "More Information" or "Support Information" links; clicking either one is a pointless exercise, unless increasing a user's frustration is the point. (!)

Well no biggie I guess. I rarely use IE (i'm still on v8) and eventually they will straighten out the directions for us non-v11 users.

 

[UsernameIssues]

~~~
I rarely use IE (i'm still on v8) and eventually they will straighten out the directions for us non-v11 users.

Then why stay at IE8? An evil file that comes into your computer can still make use of IE8 - even if it is not the default browser.

That said, several businesses only supply/support IE8 :-(