Patches: MS06-040 Tested and Deployed

Since Wednesday, I’ve been testing and deploying MS06-040. This includes a collection of systems, ranging from Windows 2000 SP4 systems, to Windows 2003 SP1 systems, to SBS 2003 systems. Thursday has been a very long day.

The only issue that I saw was on a Windows 2000 SP4 system, running Exchange 2000 SP3. The system hung when prompted to reboot; using the Dell DRAC interface I was able to reset the box. When it came back up, the Exchange services were stopped. Manually restarting the services and re-mounting the databases in ESM resolved the issue.

Since the issues were resolved fairly easily - and knowing that PF usage on the box was a bit high prior to patching, I did not contact PSS. I don’t necessarily attribute this to the patch, but I did want to pass the experience along in case someone else sees something similar.

Patching: August updates and MS06-040 details

MS06-040, also known as VU#650769 should be your top priority right now. The consensus on Patchmanagement.org's mailing lists seem to be that MS06-040 is safe, and my own limited testing confirms this. The MSRC blog was updated earlier this morning on the release, and is a good resource to look to.

Be sure and check out Microsoft's August security bulletin summary; 9 critical updates this month that need to get distributed, as well as 3 important updates. SANS has a overview worth checking out.

Patching: Official WMF patch released (MS06-001)

The official WMF patch was released last night. I've checked all of the WSUS and SUS servers that I maintain; they're all synced-up and the patch is/was being distributed.

I’ve linked up the advisory below.

http://www.microsoft.com/technet/security/Bulletin/MS06-001.mspx

Patching: Script to deploy unofficial WMF patch

Since I didn’t have an easy way to get my systems updated with the unofficial WMF hotfix, I put together a small VBscript which can be executed at startup via GPO. You’ll need to do the following to make this work.

1) Download the unofficial hot fix
2) Put it on a share that everyone can read from
3) Create a folder that everyone can write to for logging purposes
4) Update the script to reflect the paths you’ve created

The script checks to see if the patch has already been installed; if so, it stops. Otherwise, it unregisters the DLL “shimgvw.dll” (which isn’t entirely necessary, but it’s a mitigating factor), and silently installs the patch and outputs logging information to a file called “computername”.txt where computername equals the name of the computer executing the script.

I’ve tested the script and the patch on a Virtual PC image of Windows XP SP2. The script installed as expected, and after rebooting, I ran the vulnerability checker to verify that my test system was no longer vulnerable.

Set objShell = CreateObject("WScript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")

strUnregCommand = "regsvr32 -u -s %windir%\system32\shimgvw.dll"
strComputer = objshell.ExpandEnvironmentStrings("%COMPUTERNAME%")

If objFSO.FolderExists("c:\Program Files\WindowsMetafileFix") Then
objFolder = "c:\Program Files\WindowsMetafileFix"
wscript.echo "Fix Already Installed: " & objFolder
Else


Set objExec = CreateObject("WScript.Shell")
strInstallPatch = "\\server\IT\Utilities\wmffix\wmffix_hexblog13.exe /NORESTART
/VERYSILENT /SUPPRESSMSGBOXES /log=\\server\logs\wmffixlog\" & strComputer & ".txt"


Set objExec = objShell.Exec(strUnregCommand)
strExecResults = LCase(objExec.StdOut.ReadAll)

Set objExec = objShell.Exec(strInstallPatch)
End if


Patching: WMF Exploit patch

With the risks surrounding the WMF exploit, combined with the fact that we haven’t seen a patch yet from Microsoft, Iifak Guilfanov of hexblog.com coded up a hotfix that seems to do the trick. Antivirus vendors are still pushing out definition updates that are effective against at least some of the exploits, but the patch over at hexblog has been dubbed the most-effective solution currently available.

Handlers at SANS ISC have looked through the code, and are strongly recommending that this unofficial patch be used until something more permanent is available from Microsoft – but until something more permanent"> nothing is expected until the next scheduled path-release date on January 10th.

The MSI file which would have made patching quite a bit easier has been pulled due to some type of problems, and as a result we’re left without a way to easily distribute the patch.

MS05-051: Get those 2000 servers patched

In case you somehow missed the fact that it’s patch Tuesday, SANS has a quick analysis on today’s patches. Then, make sure you head on over and get the technet take while your at it.

In the mean time, the short version is that MS05-051 (CAN-2005-2119) is going to be a problem for those still on Windows 2000 server. And before you say it, I live in the real-world with the rest of you. I have customers still on 2000, that can’t/won’t move to 2003 yet. Apparently, you can disable the DTC service to mitigate this. But it’s probably best to get things patched.

Talk to your customers. Patch early. If you can, patch now – I am as as I write this at 11:30pm. Just make sure to do it soon, before the eEye template that was released is used and we start seeing some exploits.