Security Bulletin MS14-045 rereleased

[Brink]

Every month for many years, we’ve released a number of updates focused on the continuous improvement of customers’ experiences with our technology. Historically, these updates happened at different times during the month, with the security-specific ones occurring on the second Tuesday of each month. Recently, to further streamline, we decided to include more of our non-security updates together with our security updates and begin the global release to customers on the second Tuesday of each month.

This month we had our first roll out with additional non-security updates. A small number of customers experienced problems with a few of the updates. As soon as we became aware of some problems, we began a review and then immediately pulled the problematic updates, making these unavailable to download. We then began working on a plan to rerelease the affected updates.

Today, we rereleased Security Bulletin MS14-045 to address kernel-mode driver issues, which you can learn more about through a review of the information contained here.

We encourage customers to install the security update as soon as possible. Customers with automatic updates enabled do not need to take any action. If you don’t have Windows Update enabled, we encourage you to do so now. If you’re not sure whether you’ve enabled Windows Update, you can check here. For organizations, your IT Group, the team or person administering the network, would be the best place to check.

Tracey Pretorius, Director
Microsoft Trustworthy Computing

Source: Security Bulletin MS14-045 rereleased - MSRC - Site Home - TechNet Blogs

 

[ThrashZone]

This sounds more like a intranet security issue ?

Executive Summary

This security update resolves three privately reported vulnerabilitiesin Microsoft Windows. The most severe of these vulnerabilities could allow elevation of privilege if an attacker logs on to the system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit these vulnerabilities.

 

[Seffrid]

Thanks.

That reads as if they had problems with some non-security updates and have reissued one of them as a security update.

I'm confused!

In any event, in the light of this month's update problems I have resolved to delay installing all updates by a week rather than the usual 2 or 3 days. This is in accordance with the advice on the official forums from the MVPs.

 

[ThrashZone]

It would be a wonder if people were still on auto updating after having issue with the last round

 

[Seffrid]

This sounds more like a intranet security issue ?

Executive Summary

This security update resolves three privately reported vulnerabilitiesin Microsoft Windows. The most severe of these vulnerabilities could allow elevation of privilege if an attacker logs on to the system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit these vulnerabilities.

It certainly doesn't sound like something that is a threat to my two home computers (which are not linked other than by using a router for their internet connection) and which no-one else has access to apart from Mrs Seffrid when shopping online! I don't have access to my company's intranet at home, as agreed mutually between me and IT.

 

[ThrashZone]

I'm not sure that's all true,
Running a administrator account could morph the threat just as easily ?

 

[Seffrid]

By way of clarification to my earlier post, I should have mentioned that I only use wired connections, I don't have any wireless appliances in use, at least not any that are set for wireless mode.

 

[ThrashZone]

Thanks I don't believe it matters,
A corrupt program downloaded when using a administrator account has the same privilege as the user downloading it if the program is malicious,
So there's your login info and the same machine/ network.. wired or not

I'll probably flip a coin in a little while and decide on if to do the update or not today,
Possibly best two out of three..

 

[Seffrid]

Thanks Thrash.

What then is the significance of the attacker having to be able to log on locally? I never have understood that particular requirement.

 

[Layback Bear]

I just ran a check for WU and their it was.
I just downloaded and installed it. Rebooted and so far all is well.

 

[ThrashZone]

Yep I lost the coin toss loaded and nothing to see here

Locally can mean a couple of things,
Your account would be locally or any existing admin. user account/ other machines..,
Or someone that hacks your network,
Wired networks are better but wires run outside and you can't control every connection and modems are not fool proof
But I'm guessing

 

[Phone Man]

The new update replaced one from Aug 12.

Jim

 

[robinb9]

I hate when ms does this, I maintain 40 computers and I do all their updates, and what is worse I have done 10 already that are on monthly maintenances. Now I have to go back to those and put on this update,,,grr

 

[Callender]

It's suggested to remove the old patch first

I missed that bit about removing 2982791 first. Now I have to uninstall both updates and reinstall 2993651.

Source:

Updated: August updates cause trouble for some Windows users | www.winhelp.us

 

[RoasterMen]

So my computer received this update today. Is it safe to install it? I hope they fixed the problem already.

 

[Urthboundmisfit]

Say WHUT?

MS14-045: Description of the security update for kernel-mode drivers: August 27, 2014

Known issues with this security update

• Known issue 1
  
  After you install this security update, fonts that are installed in a location other than the default fonts directory (%windir%\fonts\) cannot be changed when they are loaded into any active session. Attempts to change, replace, or delete these fonts are blocked, and a "File in use" message is displayed.
  
  For more information, go to the following Microsoft webpages: Font Installation and Deletion
  AddFontResource function
  AddFontResourceEx function
  RemoveFontResource function
  RemoveFontResourceEx function
• Known issue 2
  
  After you install this update, the z-order of the windows is changed. (The z-order calls the SetWindowPos function together with the HWND_TOP parameter.) Therefore, the windows of certain applications may become invisible or may be incorrectly displayed behind other windows.
  
  Status
  We are currently working on a resolution for this issue.
  
  Notes
  This issue also occurs after you install the following updates:
  • 2965768 Stop error 0x3B when an application changes the z-order of a window in Windows 7 SP1 and Windows Server 2008 R2 SP1
  • 2970228 Update to support the new currency symbol for the Russian ruble in Windows
  • 2973201 MS14-039: Description of the security update for Windows on-screen keyboard: July 8, 2014
  • 2975719 August 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2

:shock:

 

[Anak]

Urthboundmisfit, I saw known issues #2 also, never in my wildest dreams did I think......

I guess I'm going to have to try this hotfix,

2965768 Stop error 0x3B when an application changes the z-order of a window in Windows 7 SP1 and Windows Server 2008 R2 SP1

May be tomorrow, or wait until the Status changes;
Status
We are currently working on a resolution for this issue.
Getting late for me, yeah, I'm going to wait until the status changes: I installed 2993651 and for the very first time since we've had this machine I saw this, apologies for the flash glare:



Happened right after Starting Windows started. Locked up tighter than a drum, I had to use the power switch, go into to safe mode and do a system restore. Everything seems to be back okay, knock on wood

The only difference since August's Black Patch Tuesday was a new keyboard back on the 1st of August and it went through them okay, see specs.

 

[lehnerus2000]

So it looks like this update should still be avoided.

 

[Urthboundmisfit]

So it looks like this update should still be avoided.

Installed on 7 HomePrem host & guest VM, no ill effects as of yet.

 

[NoelDP]

Let's not forget that there are over a billion copies of Windows out there - and we only get to see the ones that go wrong.
Overall, the failure rate is VERY low - I'm actually vaguely surprised that we don't see more pulled patches.
MS was a little slow on the ball in terms of pulling this one - which probably means that it had a relatively low impact rate (or that the machines were too stuffed to be able to report the failure!).

It would be nice if they published an analysis of the problem, but in the case of Security updates, I can see reasons for not doing so.