Info about the emergency Windows update

17 years ago

I mentioned this special out of band emergency windows update on another thread but it is pretty important so this is a tread about that.

Here is the article just emailed out by windows secrets. QUOTE:

Microsoft posts emergency defense for new attack

Susan Bradley By Susan Bradley

A remote-code exploit that could spread rapidly like the 2003 MSBlaster worm is putting all versions of Windows at risk.

I recommend that you immediately install a patch that Microsoft has just issued to protect your system from a vulnerability in the Server service.

MS08-067 (958644)

Rare out-of-cycle patch emphasizes the risk

With little warning, Microsoft released yesterday an unscheduled or "out-of-cycle" patch for a highly critical vulnerability that affects all versions of Windows. Security bulletin MS08-067 (patch 958644) was posted to warn of a remote-code attack that could spread wildly across the Internet.

Microsoft says it found evidence two weeks ago of an RPC (remote procedure call) attack that can potentially infect Windows machines across the Net with no user action required.

Windows Server 2003, 2000, and XP (even with Service Pack 2 or 3 installed) are particularly vulnerable. Vista and Server 2008 gain some protection via User Account Control, data-execution protection, and other safeguards, as explained in an article by Dan Goodin in the Register.

While firewalls are a first line of defense against this attack, don't think you're secure just because you have a firewall. Malware and viruses use many different techniques to wiggle their way into our systems.

For example, my office's networks are protected by firewalls on the outside, but inside the network, PCs have file and printer sharing enabled. If a worm got loose inside the office network (and the patch hadn't been installed), the attack would spread like wildfire.

Many antivirus vendors have already issued definition updates that protect against this attack. Your antivirus program, however, may not protect you completely even if your AV definitions are up-to-date. Early reports indicate that there are already nine different strains of viruses trying to take advantage of this vulnerability. We can expect more to come, so even the best AV application may not be able to update fast enough.

I've tested this patch and have had no problems applying it. I strongly urge you to download and install this patch manually. Restart your PC before installing any patch to verify that your machine is bootable. Then be sure to reboot again after installing the patch, so the patched binaries completely replace the vulnerable components.

Microsoft has posted several versions of the patch that apply to different operating systems:

Windows 2000 with Service Pack 4 patch download

Â Windows XP with Service Pack 2 or 3 patch download

Â Windows XP 64-bit Edition patch download

Â Windows Server 2003 with Service Pack 1 or 2 patch download

Â Windows Server 2003 64-bit Edition patch download

Â Windows Vista with or without Service Pack 1 patch download

Â Windows Vista 64-bit Edition with or without Service Pack 1 patch download

Â Windows Server 2008 32-bit Edition patch download

Â Windows Server 2008 64-bit Edition patch download

More information: Please read security bulletin MS08-067. For an excellent technical explanation of the vulnerability and possible mitigations, read TechNet's Oct. 23 description. (TechNet incorrectly refers to MS08-067 as "out-of-band," but the patch is simply out-of-cycle, because it wasn't released on Microsoft's usual Patch Tuesday monthly cycle.) END QUOTE.

Here is the actual link to that article

Microsoft posts emergency defense for new attack

Advance Notification for Out-of-Band Release

Microsoft Security Bulletin MS08-067 Â Critical

and these are some articles telling what the exploit is about.

Microsoft RPC exploit could be a packaged deal

Microsoft Patches Vulnerability as Hackers Launch Attacks

We are seeing no problems coming in from installing this emergency patch, I have done the installs on mine and it went fine, the forums I am on are seeing no problems from the patch. So I would definitely advise getting this one now to be on the safe side

Sort by:Oldest

Comments (20)

genes
17 years ago
last modified: 11 years ago
The way I read it in the graph and links provided in the chart below was if you have
XP SP2 or 3, there is no update required nor supplied.
Also, those with Vista 32 bit SP1 and Vista 64 bit SP1 are also not affected
baldy_linux
17 years ago
last modified: 11 years ago
Nope genes you got it wrong there is a patch for all windows computers it is a major nasty and it is needed to stop from becoming a zombie.I have a windoze gaming machine with XP and sp3 and there was a patch last night.
Related Discussions
upcoming update to Windows update
Q
Comments (6)
Postings on the tech support forums I am on are indicating that this update has started being pushed out. You may notice your pc telling you it has updated and needs to be rebooted even when you did not do any updates. The only way to stop it is to completely turn off updates. So far I am not seeing any problems related to this update, but will let y'all know if I do. There is also another Windows Genuine Advantage Notification tool update happening, here is some info. Windows Genuine Advantage Notification (KB905474) Date Published: 8/25/2008 Brief Description The Windows Genuine Advantage Notification tool notifies you if your copy of Windows is not genuine. Overview The Windows Genuine Advantage Notification tool notifies you if your copy of Windows is not genuine. If your system is found to be non-genuine, the tool will help you obtain a licensed copy of Windows. Please note Starting this week, we will begin deployment of the latest version of WGA Notifications for Windows XP. In addition to the usual updates to validation that improve WGA's ability to detect the latest stolen or fake product keys and other attempts to circumvent product activation, this release will also include a couple of other significant updates. Continued at source along with screen shots Update to WGA Notifications Description of the Windows Genuine Advantage Notifications application
...See More
Toshiba T135D Emergency BIOS Update
Q
Comments (15)
As expected, trouble. On the first attempt to update the BIOS the computer froze-up, no display updates (clock continued to show the start time) or response to keyboard or mouse, including keyboard on the notebook itself. The installation seems to have done the checks on the new and old BIOS, but froze when it started to "flash" the BIOS. I called Toshiba TS, I'll give them a passing grade as it took only about 5 minutes of voice prompted filtering to get to a person, who had to transfer me to a specialist on the BIOS update. After some discussion of the situation he told me to hold the power button down for 10 seconds (it takes about 5 second) so that the computer would reboot. The computer did reboot with the old BIOS. He said try again, and after dinner I did. This time there were some error messages on the screen, but the process continued forward with blow-by-blow reporting to me on the installation dialog box. When all done the new BIOS was as wanted (F2 pushed during boot to get to BIOS setup) and I hit F9 to set defaults and F10 to save changes - as instructed by Toshiba. All seems well, for now. Related, how can I see what version of BIOS is being used without going through a reboot and F2 trigger? I thought that information was available on the device manager or on the properties of my computer. I couldn't find the BIOS version using those facilities. I have Windows 7 Home Premium.
...See More
Any info on Windows 10?
Q
Comments (19)
I know it won't be like XP or /W7, but hopefully it will be a bit more like it. It's not just some of the users in here it people all over the country, even MS admits it did not go over well, their sales went down. That is why they are changing it. On one MS site they admitted they made a mistake. I have W8 on my laptop with Classic shell, if 10 is like that I will be happy with it. I try to adjust to changes in electronics because I don't want to be left behind. But, if I can find away to make my pc easier to use I will.
...See More
Any info about summer/winter hook up, oil heat?
Q
Comments (10)
Here's the extent of my knowledge. It's not much but may get you started. Be sure to get a home inspection before you sign a contract! Summer/Winter Hook-Up Systems Summer/winter hook-up systems use a gas or oil fired boiler to heat hot water for radiator or baseboard heating. They also provide the hot water for your house and eliminate the need for a water heater tank. Since this type of system is in use year round, even when there is no need for heat, it is called a summer/winter hookup. The hot water supplied by the boiler for personal use is the same temperature as the water used to provide heat. Therefore, the output temperature of hot water at sinks, faucets, and bathtubs in the house can exceed 150 degrees. This is a very dangerous temperature that can result in instant scalding and burning of exposed skin. To prevent accidental scalds, a tempering or mixing valve should be attached to the main hot water supply line. The tempering valve mixes cooler water with the hot water from the boiler to reduce the temperature of personal use hot water to a safe level. Summer/winter hook-up systems also have a temperature & pressure relief valve. Its purpose is to discharge water from the boiler if the internal water temperature of the boiler exceeds 210 degrees F or 30 PSI. If water temperatures or pressures were allowed to exceed these points, the boiler could become damaged or worse, the boiler could explode. The TPR valve should have a directional pipe installed that points towards the floor and ends about six inches above the floor. This helps prevent anybody standing nearby from getting burned with scalding water if the TPR valve were to open. This exhaust pipe should never be capped or plugged shut. /tricia
...See More
breenthumb
17 years ago
last modified: 11 years ago
I just installed it and all's fine here. Sandy
breenthumb
17 years ago
last modified: 11 years ago
I've turned off computer to install--twice- and the notice is still in the box ("Click here to turn off without installing.") Now I don't know if it installed or not. Sandy
ravencajun Zone 8b TX
Original Author
17 years ago
last modified: 11 years ago
in the actual link to the article I quoted for each version that is listed there in the article there is a blue clickable link where it says patch download, they did not come through as clickable links when I copied and pasted it here. So YES there are definitely patches out for all versions of windows this one affects everything that I have seen.
Genes the link you provided from my post has a large box down in the article that is a list of all AFFECTED versions on it. That list is this.
Affected Software
and the direct QUOTE from MS
"This security update is rated Critical for all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, and rated Important for all supported editions of Windows Vista and Windows Server 2008. For more information, see the subsection, Affected and Non-Affected Software, in this section." END QUOTE

I have xp home and pro sp2 and got the patch.
The reason for the rush to get people to do this asap is that they are already seeing the bad guys using this vulnerability in the wild and know it will be spreading quickly since it has been outed.
morz8 - Washington Coast
17 years ago
last modified: 11 years ago
XPSP2 here, and I installed the patch last night after reading about it - tiny and quick, restart required.
gillian_41
17 years ago
last modified: 11 years ago
XPsp2 here also, went to Microsoft upgrade this morning everything went well and thats a plus for me.
lynnalexandra
17 years ago
last modified: 11 years ago
Ravencajun - thank you so much for posting this. I'm sure I would have missed it otherwise. I'm getting conditioned to assume that only on update Tuesdays do I need to check - every other time it had just been for SP3 - which I don't want.

I still haven't downloaded the Oct.14 updates - is that safe now or should I wait?

Thanks.
Lynn.
ravencajun Zone 8b TX
Original Author
17 years ago
last modified: 11 years ago
I have done all of them Lynn except sp3 and had no problems at all with my xp machines.
zep516
17 years ago
last modified: 11 years ago
Sandy if your using xp you can check your add/remove programs list to see if it is installed.

Should be listed as --Security update for Windows XP(kB958644).

In the link below you will find more information and a direct link to the download for your operating system, of course remember to use Internet Explorer if you need to download.

Lynn I do not see any updates on my XP Machine for Oct,14 and that machine is set on auto updates....??????????
breenthumb
17 years ago
last modified: 11 years ago
Thanks Zep. I had done Restart instead of actually Turn Off. Guess that's not good enough, even though it shuts down and reboots. I've turned it off and back on and its installed now. Sandy
lynnalexandra
17 years ago
last modified: 11 years ago
Zep - I definitely got notified of a few updates on update Tuesday for October. I've started downloading those - just did for my laptop and my daughter's computer. I'll do my desktop later.

Lynn.

PS - I love Secunia - having learned of it here this summer - but I do find it sometimes doesn't completely correspond with the results I get if I go to Microsoft Updates site.
ravencajun Zone 8b TX
Original Author
17 years ago
last modified: 11 years ago
yes Oct 14 was the regular patch Tues and it had a lot of updates from between 7 to 12 I think depending on system. They did cause a few issues for some but they did reissue an updated update which I think helped.
I had no problems with any of them
ginny12
17 years ago
last modified: 11 years ago
The emergency update automatically installed for me last night. No problems. I had to go look to see if it was there. My kind of update.
stargazzer
17 years ago
last modified: 11 years ago
I went to windows update and downloaded it, no problems so far.
shaddy101
17 years ago
last modified: 11 years ago
How do we be sure we are getting the right one? I have many updats on my list, and am skeered that I pick the wrong ones, or ones that I don't really need. How does one go about being sure which ones are proper uaage?
The last time I updated, things changed so drastically, I was in a fog for several days, don't want that to happen again!
Someone with advice please?
ilmbg
17 years ago
last modified: 11 years ago
How do I know exactly which one I have? As far as I know, I have Winxp home. I saw one for xp, but is it for xp professional, or home? Also, what is the 'sp2', 'sp3'- is this anything I have?
Thanks
lindajewell
17 years ago
last modified: 11 years ago
Mine downloaded yesterday, I installed with no problems. Thanks for the heads up Ravencajun and for posting links to the related articles.
ilmbg
17 years ago
last modified: 11 years ago
OK- I see mine downloaded 10/24. I also have pack 2 & 3, loaded on its own also.
ravencajun Zone 8b TX
Original Author
17 years ago
last modified: 11 years ago
shaddy just go to the windows update site and let it scan your pc it will give you the one that is correct for your pc the actualy KB number for that specific update is KB958644. If it shows you updates that are under the critical category you should get them, sp3 will be shown as a separate update which you can select not to get.

Start> all programs> at the top windows update You must do it with IE.

Info about the emergency Windows update

Comments (20)

genes

baldy_linux

Related Discussions

breenthumb

breenthumb

ravencajun Zone 8b TX
Original Author

morz8 - Washington Coast

gillian_41

lynnalexandra

ravencajun Zone 8b TX
Original Author

zep516

breenthumb

lynnalexandra

ravencajun Zone 8b TX
Original Author

ginny12

stargazzer

shaddy101

ilmbg

lindajewell

ilmbg

ravencajun Zone 8b TX
Original Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Info about the emergency Windows update

Comments (20)

Related Discussions

ravencajun Zone 8b TXOriginal Author

ravencajun Zone 8b TXOriginal Author

ravencajun Zone 8b TXOriginal Author

ravencajun Zone 8b TXOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

ravencajun Zone 8b TX
Original Author

ravencajun Zone 8b TX
Original Author

ravencajun Zone 8b TX
Original Author

ravencajun Zone 8b TX
Original Author