Windows Secrets Newsletter • Issue 57 • 2005-07-14 • Circulation: over 400,000

By Susan Bradley

Where has the year gone?  We’re already to the first Patch Tuesday of July, which means we have half of our patches for the year under our belt and the other half to come.

Tuesday’s batch of patches are for one old standby program that many new systems aren’t even running anymore (MS Java Virtual Machine), another for Office, and the last one to fix a buffer overrun affecting images. These patches prove once again we need to get away from running our machines as Administrator (and get developers to release programs that can run as User).

Office patches are now MU-able

MS05-035 (903672): One thing to remember about the Word patch this month is that you can have this patch come to you in the new one-stop patch tool called Microsoft Update (MU), which is appropriate for home users and small businesses without WSUS or other update-management software.

All of this week’s patches, in fact, are deployable using MU. So step number one, if you haven’t already done so, is to “flip” yourself over to Microsoft Update and use that to patch individual machines.

To do so, jump to the Microsoft Update page. (This link in particular, and MU in general, require the use of Internet Explorer and other browsers won’t work.) The MU page will enroll you in the new update engine, which upgrades Office, SQL Server, and other Microsoft applications in addition to Windows.

Office 2003 is not vulnerable to the exploit described in MS05-035, which affects earlier versions of Word and all versions of Microsoft Works Suite since 2000.

The key element you need to take away from this patch is the fact that the attacker only gains the rights the user currently has. Thus, if you’re running your system as a “restricted user,” you don’t need to be as concerned about patching. Of course, we still face many programs that won’t run in restricted-user mode. I was recently quoted in an eWeek article by David Coursey, which describes the problem and links to listings of such offenders.

Don’t get me wrong, I always recommend patching your machines. But running in restricted-user mode from the get-go (if your applications support it) gives you the confidence to patch on your own schedule instead of frantically. For more information, see MS05-035.

Not another confusing image patch?

MS05-036 (901214): Microsoft Security Bulletin MS05-036 is a bit of an odd bulletin, about as odd as the Jview profiler patch (which is covered above in Chris Mosby’s column). I hope it doesn’t turn into something like the confusing Jpeg patch, which had to be re-released by Microsoft.

I’ll be flat out honest with you that, while the problem description says “Microsoft’s color management module,” I’m just not sure whether or not other platforms may have similar issues. A lot of things handle “ICC profile format tags,” such as printers. See MS05-036

What does Microsoft Update do, anyway?

In my June 30, 2005, column, I urged folks to switch to Microsoft Update and let me know what they thought of the experience.

First off, let me assure you that if you flip to Microsoft Update, you can quite easily flip back. The first thing that occurs when you opt into Microsoft Update is that an ActiveX control is downloaded to your machine.  If you want to flip back and forth between Windows Update and Microsoft Update, follow KB 901037 to toggle them on and off.

But, honestly, I can’t see any reason why you’d want to go back to Windows Update once you’ve switched to Microsoft Update. Most importantly, it patches Office as well as Windows, when needed. I know you’ve been told to visit Office Update to keep Office up to date. But do you really remember to do that?

Log files you might need to look at

One thing to keep in mind with the new version 6 of Windows Update and Microsoft Update is that the log file format is changing.

The v4 version is stored as Windows Update.log. The new version 6 (which gives details of both version 6 of Windows Update and Microsoft Update) is stored as WindowsUpdate.log. To make heads or tails from the gobbletygook in this file, look no farther than KB 902093.

WSUS and SBS 2003 sp1 installing issues

One issue we are tracking is a problem installing WSUS (Windows Software Update Services) on Small Business Server 2003 OEM-installed servers. (This means that you or your consultant set up the machine “as is” from the OEM manufacturer and haven’t reinstalled SBS 2003 from scratch.)

At this time, we’re seeing spotty reports that folks are having issues getting WSUS installed on these servers. For now, if you have this type of Small Business Server, hold off on the installation and stay tuned until there is a final resolution.

Meanwhile, if you’re seeing Blue Screen of Death issues when installing Small Business Server 2003 SP1 on Dell OEM machines, you’re urged to call Microsoft Product Support Services and open a no-charge support incident.

Claria deal no-go and other good news

It was a great relief to hear from Clickz News that the rumored deal between Claria and Microsoft has fallen though. Meanwhile, it appears, based on a new Pew Internet study, that all this spyware is causing us to change our surfing, clicking and Internet habits. Almost half of those surveyed say they’ve stopped visiting Web sites that might deposit unwanted programs. Too bad, that might include your site. Spyware is a terrible scourge..

By Mark Burnett

A number of years back, I owned a car with a seatbelt that automatically ran along a track and over my shoulder as soon as I closed my car door. It was one of the first of its kind and I thought it was very cool. The only problem was that you still had to manually pull the lap belt over to be completely safe (and not be decapitated in a crash). Unfortunately, the automated shoulder strap gave such a false sense of security that it was easy to neglect the lap belt.

That’s beginning to be the problem with patch management. Patch management used to be such a time-consuming, manual chore that it’s a great relief having so many tools to do it for you now. For many users, you can just turn on Automatic Updates and really not have to worry much. The only problem with this is that is makes it so easy to lapse into a false sense of security.

Home users can usually get away with this. But if you manage a network of systems for your organization, you really should spend some time knowing what’s going on with each month’s new patches.

There’s wisdom in the Knowledge Base

If you haven’t noticed, Microsoft has made some great improvements in their security bulletins and Knowledge Base articles concerning new patches. The articles used to be vague and defensive, but now are loaded with clear details outlining each vulnerability. It’s well worth the time to read these bulletins, even though you might already use a completely automated update-management solution.

These articles provide a good explanation of the security issue, offer workarounds, and explain factors that might mitigate the impact of the vulnerability. Occasionally, there are important notes that might greatly affect the impact of the vulnerability on your systems.

Sometimes, a vulnerability that’s critical for one environment may have no importance in another environment. In some cases, reading the article will make you realize you don’t even need to install the patch after all.

Creating a set of key information

Every Patch Tuesday, I have to create summary reports for various clients. It doesn’t take me long and it gives me a much greater understanding of the issues. The process is so informative that I recommend it for anyone in charge of managing more than a few systems.

Some of the information I look for is the severity rating of a patch, whether the patch requires a reboot or not, what files will be updated, what is the impact of the vulnerability, what mitigating factors might exist, and what other workarounds might be available.

After doing this month after month, I discovered some interesting facts. For example, I keep seeing the same mitigating factors and workarounds — patch after patch.

Even if the workarounds aren’t precisely the same, they follow the same best practices and are a great way to learn to think like a security expert. Another helpful benefit of understanding the issues is that it’ll be easier to recognize them if they happen to you.

Microsoft spends a lot of time now developing these articles and there’s a lot more information there to see. But a lot of people never read these useful tips because their whole patch-management process has become so automated.

Don’t let automation make you complacent

That’s the problem with many types of security — the more you automate it, the more you can forget about it. But the more you forget about it, the easier it is to pretend the problem isn’t there.