ConfigMgr 2012 : Patching

MS KB2823324 patch could cause loss of OS on next reboot if deployed

Rob Marshall - MVP — Sat, 13 Apr 2013 12:07:29 GMT

Lots of chatter out there on the web on this, Microsoft has pulled a patch, KB2823324, that is reportedly causing Windows OS’s not to boot properly or for application to not function correctly.

If you haven’t got this out into production yet, think it’d be a sensible precaution to remove it from any Deployment Packages and prevent any production instability until it is all resolved.

http://support.microsoft.com/kb/2823324

August 2010 Patch Day looming

Rob Marshall - MVP — Fri, 06 Aug 2010 08:01:00 GMT

I've fallen out of the routine of announcing the patches each month, I felt that if it wasn't a notable release, well, then there is no reason to duplicate what a zillion other folk are happily duplicating, instead I assume you've signed up to the bulletin announcement mailing list and are getting these announcements straight from the horses mouth (Microsoft). To sign up for an email announcement, click here

So, without much further ado, here comes August, a notable month indeed :-)

Looky here, 14 patches have been announced, but for some of us it is going to be 15 if we haven't already deployed the out of band release that was released at the tail end of July ...

This is an advance notification of security bulletins that Microsoft is intending to release on August 10, 2010.

The full version of the Microsoft Security Bulletin Advance Notification for August 2010 can be found at http://www.microsoft.com/technet/security/bulletin/ms10-aug.mspx.

This bulletin advance notification will be replaced with the August bulletin summary on August 10, 2010. For more information about the bulletin advance notification service, see http://www.microsoft.com/technet/security/Bulletin/advance.mspx.

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications on http://www.microsoft.com/technet/security/bulletin/notify.mspx. <--- Yes that means you! Sign up and get this kind of information in a timely manner direct from Microsoft

Microsoft will host a webcast to address customer questions on these bulletins on August 11, 2010, at 11:00 AM Pacific Time (US & Canada). Register for the Security Bulletin Webcast at http://www.microsoft.com/technet/security/bulletin/summary.mspx.

Bulletin ID	Max Sev Rating	Vuln Impact	Restart Req	Affected Software
Bulletin 1	Critical	Remote Code Execution	Requires restart	Microsoft Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.
Bulletin 2	Critical	Remote Code Execution	Requires restart	Microsoft Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.
Bulletin 3	Critical	Remote Code Execution	May require restart	Microsoft Windows XP and Windows Server 2003.
Bulletin 4	Critical	Remote Code Execution	Requires restart	Internet Explorer on Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.
Bulletin 5	Critical	Remote Code Execution	Requires restart	Microsoft Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.
Bulletin 6	Critical	Remote Code Execution	May require restart	Microsoft Windows XP, Windows Vista, and Windows 7.
Bulletin 7	Critical	Remote Code Execution	May require restart	Microsoft Office Word 2002, Word 2003, Word 2007, Office 2004 for Mac, Office 2008 for Mac, Open XML File Format Converter for Mac, Office Word Viewer, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats, Works 9.
Bulletin 8	Critical	Remote Code Execution	May require restart	Microsoft Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Microsoft Silverlight 2, and Microsoft Silverlight 3.
Bulletin 9	Important	Elevation of Privilege	Requires restart	Microsoft Windows XP, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.
Bulletin 10	Important	Elevation of Privilege	Requires restart	Microsoft Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.
Bulletin 11	Important	Remote Code Execution	May require restart	Microsoft Windows XP and Windows Vista.
Bulletin 12	Important	Remote Code Execution	May require restart	Microsoft Office Excel 2002, Excel 2003, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac.
Bulletin 13	Important	Elevation of Privilege	Requires restart	Microsoft Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.
Bulletin 14	Important	Elevation of Privilege	May require restart	Microsoft Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

Get Ready!

Patching Windows 2008 Server Core with ConfigMgr

Rob Marshall - MVP — Sat, 15 May 2010 09:36:00 GMT

Found a good article over on Nathan's blog detailing how to patch with the WUA client, Windows 2008 server core.

Support came for W2008C in ConfigMgr SP1, but to patch it you'll need to setup the usual on the ConfigMgr side then run a vbcript on the W2008C server to initiate the patch install.

http://msdn.microsoft.com/en-us/library/aa387102(VS.85).aspx

Here's another ace link, from technet on supporting Windows 2008 with the ConfigMgr client

http://technet.microsoft.com/en-us/magazine/2008.11.managing.aspx

Important: SMS2003 ITMU Patch issue for April 2010 patch set

Rob Marshall - MVP — Tue, 11 May 2010 07:29:00 GMT

Defo one to watch out for if you're using SMS2003 + ITMU to deploy the April 2010 patch set

The ConfigMgr support team blog:

We've been getting some calls about this one so I thought it deserved a mention here. If you're having some ITMU related issues with the April 2010 security patch install then you'll want to take a quick read of this one. Note that this issue only affects SMS 2003. Our currently supported products, ConfigMgr 2007 and WSUS 3.0, do not share this limitation.

=====

Issue: Deployment of the April 2010 security patches requires two executions of PatchInstall.exe and may require two reboots of the client. On the first execution, the PatchInstall.log shows:

INSTALL FAILED: UpdateID = 804db346-55c5-44b7-8491-1ecf77062836, QNumber = 978601, Title = Security Update for Windows XP (KB978601), ExitCode = 1642, Executable = C:\WINDOWS\system32\VPCache\PackageID\SmsWusHandler.exe /InstallFile:"\\DPServer\SMSPKGx$\PackageID\804db346-55c5-44b7-8491-1ecf77062836\windowsxp-kb978601-x86-enu_49ae6ac4f6e0a609124f2ce6f80fcef249273c02.exe" /UpdateID:804db346-55c5-44b7-8491-1ecf77062836

Check out more here: http://blogs.technet.com/configurationmgr/archive/2010/05/10/sms-2003-itmu-v3-requires-two-passes-two-reboots-to-deploy-april-2010-security-patches.aspx

Microsoft August 2009 Patch releases - Huge filesizes this month

Rob Marshall - MVP — Wed, 12 Aug 2009 08:59:00 GMT

We just added up the patch sets for August 2009 to 1.3GB. Holy cow that is a lot of content to be pushing out for patching. Little bit of looking and you'll discover that the main culprit is Visual Studio.

We've seen this before for SQL patches, but the size of the patches for Visual Studio are just stupidly huge. Just don't understand why we are deploying what looks like full installers just to fix a problem. For those of you struggling to manage the disk space on your DP's, be prepared to see over a GB disappear this month depending on what you push out.

I'd recommend splitting out the visual studio stuff as a seperate patch list\package and only assign it to DP's where it really is required and that have enough disk space. If you have ample disk space on your DP's throughout your hierarchy, consider yourself blessed!

Here is the August 2009 bulletin: http://www.microsoft.com/security/updates/bulletins/200908.aspx

And here is a good break down of each patch brought to you by Justin James over on TechRepublic: http://blogs.techrepublic.com.com/window-on-windows/?p=1414

Patching: Security Update for SQL Server 2000 Service Pack 4 (KB960083) Failed to install

Rob Marshall - MVP — Mon, 16 Mar 2009 12:56:00 GMT

Security Update for SQL Server 2000 Service Pack 4 (KB960083) fails to install

Not many of you will see this, problem manifests if a SQL instance service is set to Disabled.

Client System EventLog:

Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for SQL Server 2000 Service Pack 4 (KB960083).

Client WindowsUpdate log:

Handler :: START :: Handler: Command Line Install
Handler :::::::::
Handler   : Updates to install = 1
Handler   : WARNING: Command line install completed. Return code = 0x00002b33, Result = Failed, Reboot required = false
Handler   : WARNING: Exit code = 0x8024200B
Handler :::::::::
Handler :: END :: Handler: Command Line Install
...
...
...
COMAPI   - WARNING: Exit code = 0x00000000; Call error code = 0x80240022
REPORT EVENT: {B3B18A60-1D96-4D2B-A657-E4CDD945C7B0} <TRIMMED OUT THIS DATA} 101 80070643 CcmExec Failure Content Install Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for SQL Server 2000 Service Pack 4 (KB960083).

Lovely errors! Pass those 3D-Glasses over the error above, and you should see hidden text saying "You have a service that is disabled". If only!

Hop on to the target, find the patch in the ConfigMgr CACHE and manually run it. The Wizard will prompt you to select the instances to patch. Click on any Instances listed and it'll tell you what is wrong, that in this case, the service is disabled. Quit the patch when you've spotted the culprit.

To install it manually:

Enable the service (MANUAL best choice if it's already been disabled for a reason)
Apply the patch
Set the service back to DISABLED
Job done!

How much impact is this to us? Well that depends, as you know everything in life, even stuff as sublime as "Should you have Milk in your tea?" really depends on your tastes and preferences, and in this case you may have a taste for disabling SQL Instances. If you do, then those clients will play dumb when it comes to applying the patch.

The KB Article does indeed talk about Disabled Services:

Q. Will the updates be applied to disabled instances of SQL Server 2000, MSDE 2000, and SQL Server 2005?

A. No. Only those instances of SQL Server 2000, MSDE 2000, and SQL Server 2005 that do not have a Startup type of disabled will be updated by the installer. For more information on disabled services, see Microsoft Knowledge Base Article 953740.

I just whipped this SQL Query up to identify ConfigMgr clients out there that meet the following:

A) Have a service registered with a name that begins with "MSSQL$"
B) Has the service type set to Disabled

SELECT     v_GS_SERVICE.DisplayName0, v_GS_SERVICE.StartMode0, v_R_System.Name0 AS Expr1
FROM         v_GS_SERVICE INNER JOIN
                      v_R_System ON v_GS_SERVICE.ResourceID = v_R_System.ResourceID
WHERE     (v_GS_SERVICE.DisplayName0 LIKE 'MSSQL$%' and V_GS_SERVICE.StartMode0 = 'Disabled')

Apple OS patch release on the 12th of Feb filled in some Arbitrary code execution holes

Rob Marshall - MVP — Fri, 13 Feb 2009 10:09:00 GMT

On the 12th of Feb 2009 Apple released a slew of patches.

Dotted in amongst the list are patches for issues that look very similiar to Windows bugs, such as "arbitrary code execution".

I only blog about this to add another pebble to the debate regarding the safetly of OS's. I don't think anyone that is Pro-Apple can lambast MS for it's security holes anymore. That one-up-man-ship has to fall to the side, since Apple are obviously patching a holed ship as well. Doesn't matter how many ways you cut the cake, the OS is vulnerable to OS and Web based expliotation.

Not sure how the two products compare in terms of lines of code, components and third party add-ons, so cannot say one is more complex than the other. But, it sure is reassuring to see that this low-key announcement of patch releases from Apple shows they share the same boat as the rest of us, and makes the argument about Apple not suffering the same issues as MS kind of moot.

One big happy patching family