PDA

Bekijk Volledige Versie : After Ms patches last Wed ...


aborg@mca.org.mt
16/04/04, 21:25
Hi ..

Is anyone else having time problems on their networks?

Yesterday (Thu) I had approx 50% of my users unable to login because "the
time on the client and server are different" and I could not figure out a
way to solve it. Some people managed to login but could not get access to
shared resources; others could not login at all. I tried syncing the time
but that didn't work and several other things I tried didn't seem to work.
Having said that, I managed to get them operational after lots of cursing
but I can't say what it was that I did that solved it. I thought about the
new patches from MS and read all there is about them to see if they affect
logins/Kerberos/time service but it doesn't seem to be the case.

This morning, I found a MS white paper
(http://www.microsoft.com/windows2000/docs/_Toc528382509) which explains
how an "Access is denied" message can appear if RPC fails to authenticate
and I started thinking about those patches again. Can anyone help shed
some light on this? I fail to believe that I'm the only one on the planet
who got negatively affected by these patches, so either I'm the first to
mention it or I'm the only one with a skewed set of network settings!

Thanks


Antoine Borg
Network Administrator

Malta Communications Authority
Suite 43/44, "Il-Piazzetta"
Tower Road
Sliema SLM 16
Malta G.C.

---------
"There is something about inevitability that offends human nature. Man is
a creature of hope and invention, both of which belie the idea that things
cannot be changed. But man is also a creature prone to error, and sometimes
that makes inevitable the things that he so often seeks to avoid."
phaser-X
17/04/04, 00:55
I had a different issue after Wednesdays updates. Two win2k computers in
my office were rendered useless after the patch. They were fine before,
but as soon as the patch finished and the PC was rebooted, the CPU usage
was 100% and nothing could be done. I left both PC's sitting for about 20
minutes and the 100% CPU usage never came down. Another coworker said he
had the same issue with his home PC and he was eventually able to get into
the task manager and noticed that the system process was taking up 99-100%
of the CPU.

Anyone else experience this issue?

-pX

On Fri, 16 Apr 2004 aborg@mca.org.mt wrote:

>
>
>
>
> Hi ..
>
> Is anyone else having time problems on their networks?
>
> Yesterday (Thu) I had approx 50% of my users unable to login because "the
> time on the client and server are different" and I could not figure out a
> way to solve it. Some people managed to login but could not get access to
> shared resources; others could not login at all. I tried syncing the time
> but that didn't work and several other things I tried didn't seem to work.
> Having said that, I managed to get them operational after lots of cursing
> but I can't say what it was that I did that solved it. I thought about the
> new patches from MS and read all there is about them to see if they affect
> logins/Kerberos/time service but it doesn't seem to be the case.
>
> This morning, I found a MS white paper
> (http://www.microsoft.com/windows2000/docs/_Toc528382509) which explains
> how an "Access is denied" message can appear if RPC fails to authenticate
> and I started thinking about those patches again. Can anyone help shed
> some light on this? I fail to believe that I'm the only one on the planet
> who got negatively affected by these patches, so either I'm the first to
> mention it or I'm the only one with a skewed set of network settings!
>
> Thanks
>
>
> Antoine Borg
> Network Administrator
>
> Malta Communications Authority
> Suite 43/44, "Il-Piazzetta"
> Tower Road
> Sliema SLM 16
> Malta G.C.
>
> ---------
> "There is something about inevitability that offends human nature. Man is
> a creature of hope and invention, both of which belie the idea that things
> cannot be changed. But man is also a creature prone to error, and sometimes
> that makes inevitable the things that he so often seeks to avoid."
>
>
Andy Shaw
17/04/04, 21:35
> I had a different issue after Wednesdays updates. Two win2k computers
in
> my office were rendered useless after the patch. They were fine
before,
> but as soon as the patch finished and the PC was rebooted, the CPU
usage
> was 100% and nothing could be done. I left both PC's sitting for about
20
> minutes and the 100% CPU usage never came down. Another coworker said
he
> had the same issue with his home PC and he was eventually able to get
into
> the task manager and noticed that the system process was taking up
99-100%
> of the CPU.
>
> Anyone else experience this issue?

I have experienced this issue, eventually I was able to uninstall the
patch, the specific one that caused it was KB835732. According to some
information I found using Google it makes a difference if the Secondary
IDE Channel's Device 1 is set to use DMA if available as a transfer mode
instead of PIO Only. I'm not sure just how valid this is because I have
not tried, but I would be interested to know if anyone managed to get
this fixed after installing the patch. I'm not happy about having to
leave my system vunerable right now.

Andy
Dan Harkless
17/04/04, 21:45
On April 16, 2004, phaser-X <px@zeroday.net> wrote:
> On Fri, 16 Apr 2004 aborg@mca.org.mt wrote:
> > Is anyone else having time problems on their networks?
> >
> > Yesterday (Thu) I had approx 50% of my users unable to login because "the
> > time on the client and server are different" and I could not figure out a
> > way to solve it. Some people managed to login but could not get access to
> > shared resources; others could not login at all. I tried syncing the time
> > but that didn't work and several other things I tried didn't seem to work.
> > Having said that, I managed to get them operational after lots of cursing
> > but I can't say what it was that I did that solved it. I thought about the
> > new patches from MS and read all there is about them to see if they affect
> > logins/Kerberos/time service but it doesn't seem to be the case.
> >
> > This morning, I found a MS white paper
> > (http://www.microsoft.com/windows2000/docs/_Toc528382509) which explains
> > how an "Access is denied" message can appear if RPC fails to authenticate
> > and I started thinking about those patches again. Can anyone help shed
> > some light on this? I fail to believe that I'm the only one on the planet
> > who got negatively affected by these patches, so either I'm the first to
> > mention it or I'm the only one with a skewed set of network settings!
>
> I had a different issue after Wednesdays updates. Two win2k computers in
> my office were rendered useless after the patch. They were fine before,
> but as soon as the patch finished and the PC was rebooted, the CPU usage
> was 100% and nothing could be done. I left both PC's sitting for about 20
> minutes and the 100% CPU usage never came down. Another coworker said he
> had the same issue with his home PC and he was eventually able to get into
> the task manager and noticed that the system process was taking up 99-100%
> of the CPU.
>
> Anyone else experience this issue?

No, but I experienced a *third* issue after applying the updates on my Win2K
box. After being up for a couple of minutes, it would freeze for a moment
and then very briefly display a black screen saying:

PAGE_FAULT_IN_NONPAGED_<something>

and then reboot. The error would display so briefly that I had to read it
over the course of multiple consecutive crashes, and I never got as far as
the <something>, but some searching reveals it most likely said "AREA".

The Event Viewer revealed that a crash dump had been saved, but running
dumpchk on it wasn't all that illuminating. Nothing in the "Process"
section -- this was a pure kernel task. The Stack Trace:

ChildEBP RetAddr Args to Child
ba5b2b2c 80468f3a 00000000 fe55e01c 00000000 ntoskrnl!MmTrimAllSystemPagableMemory+0x4350
ba5b2b44 ba5b2bf8 00000246 80404151 ba5b2b88 ntoskrnl!Kei386EoiHelper+0x2994
ffffffff 00000000 00000000 00000000 00000000 0xba5b2bf8

I had noticed that before the Tuesday updates came out (why are y'all saying
"Wednesday" above?), there was a Windows Update for my onboard Intel
Ethernet, but I hadn't yet applied it. I tried installing the new driver
(my system thankfully stayed up long enough for it to complete), and after
installing it, the crashes magically went away.

I was told a Win2K user at work experienced the same thing. Seems that
Microsoft may not have spent enough time testing one of these patches on the
Win2K platform. Dunno which one, since in recent years I'd found
Microsoft's patches to be well-tested enough that I haven't made a point to
apply them only one at a time so I could identify faulty ones, as I found it
necessary to do in past years.

--
Dan Harkless
http://harkless.org/dan/
Scott Gifford
17/04/04, 23:55
phaser-X <px@zeroday.net> writes:

> I had a different issue after Wednesdays updates. Two win2k computers in
> my office were rendered useless after the patch. They were fine before,
> but as soon as the patch finished and the PC was rebooted, the CPU usage
> was 100% and nothing could be done. I left both PC's sitting for about 20
> minutes and the 100% CPU usage never came down. Another coworker said he
> had the same issue with his home PC and he was eventually able to get into
> the task manager and noticed that the system process was taking up 99-100%
> of the CPU.
>
> Anyone else experience this issue?

A consulting client of mine had the same complaint. He was only able
to fix it by re-installing Windows. You may want to mention it on
NTBugTraq, they often discuss and sort out things like this.

----ScottG.
Alun Jones
18/04/04, 00:35
phaser-X wrote:
> I had a different issue after Wednesdays updates. Two win2k
> computers in my office were rendered useless after the patch.
> They were fine before, but as soon as the patch finished and
> the PC was rebooted, the CPU usage was 100% and nothing could
> be done. I left both PC's sitting for about 20 minutes and
> the 100% CPU usage never came down. Another coworker said he
> had the same issue with his home PC and he was eventually
> able to get into the task manager and noticed that the system
> process was taking up 99-100% of the CPU.

Not that it's necessarily the case for you, but frequently patching is the
one time when reboots are almost bound to occur - as a result, an awful lot
of bugs are discovered after the patch, but not necessarily because of the
patch. General advice is to try uninstalling the patch and see if the
problem still exists, before deciding which way to debug - not very easy if
you have all your CPU locked up!

As to the "system process" taking up 99-100% of the CPU, there is a "System
Idle Process" that is _supposed_ to do that. I hope your coworker hasn't
misconstrued :-)

Try calling PSS (you know, tech support?), and see if they have any ideas.

Alun.
~~~~
--
Texas Imperial Software | Find us at http://www.wftpd.com or email
1602 Harvest Moon Place | alun@texis.com.
Cedar Park TX 78613-1419 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(512)258-9858 | Try our NEW client software, WFTPD Explorer.
plasmahh@informatik.uni-bremen.de
19/04/04, 20:35
Zitat von phaser-X <px@zeroday.net>:

> I had a different issue after Wednesdays updates. Two win2k computers in
> my office were rendered useless after the patch. They were fine before,
> but as soon as the patch finished and the PC was rebooted, the CPU usage
> was 100% and nothing could be done. I left both PC's sitting for about 20
> minutes and the 100% CPU usage never came down. Another coworker said he
> had the same issue with his home PC and he was eventually able to get into
> the task manager and noticed that the system process was taking up 99-100%
> of the CPU.
>
> Anyone else experience this issue?
>

A similar one.
When I login to my recently patched box, the start menu and everything on the
desktop isnt accesible, until I start the task manager and kill a process, it
does not matter which one...

> -pX
>
> On Fri, 16 Apr 2004 aborg@mca.org.mt wrote:
>
> >
> >
> >
> >
> > Hi ..
> >
> > Is anyone else having time problems on their networks?
> >
> > Yesterday (Thu) I had approx 50% of my users unable to login because "the
> > time on the client and server are different" and I could not figure out a
> > way to solve it. Some people managed to login but could not get access to
> > shared resources; others could not login at all. I tried syncing the time
> > but that didn't work and several other things I tried didn't seem to work.
> > Having said that, I managed to get them operational after lots of cursing
> > but I can't say what it was that I did that solved it. I thought about the
> > new patches from MS and read all there is about them to see if they affect
> > logins/Kerberos/time service but it doesn't seem to be the case.
> >
> > This morning, I found a MS white paper
> > (http://www.microsoft.com/windows2000/docs/_Toc528382509) which explains
> > how an "Access is denied" message can appear if RPC fails to authenticate
> > and I started thinking about those patches again. Can anyone help shed
> > some light on this? I fail to believe that I'm the only one on the planet
> > who got negatively affected by these patches, so either I'm the first to
> > mention it or I'm the only one with a skewed set of network settings!
> >
> > Thanks
> >
> >
> > Antoine Borg
> > Network Administrator
> >
> > Malta Communications Authority
> > Suite 43/44, "Il-Piazzetta"
> > Tower Road
> > Sliema SLM 16
> > Malta G.C.
> >
> > ---------
> > "There is something about inevitability that offends human nature. Man is
> > a creature of hope and invention, both of which belie the idea that things
> > cannot be changed. But man is also a creature prone to error, and sometimes
> > that makes inevitable the things that he so often seeks to avoid."
> >
> >
>
Jerry Winegarden
19/04/04, 21:25
On Sat, 17 Apr 2004, Scott Gifford wrote:

> phaser-X <px@zeroday.net> writes:
>
> > I had a different issue after Wednesdays updates. Two win2k computers in
> > my office were rendered useless after the patch. They were fine before,
> > but as soon as the patch finished and the PC was rebooted, the CPU usage
> > was 100% and nothing could be done. I left both PC's sitting for about 20
> > minutes and the 100% CPU usage never came down. Another coworker said he
> > had the same issue with his home PC and he was eventually able to get into
> > the task manager and noticed that the system process was taking up 99-100%
> > of the CPU.
> >
> > Anyone else experience this issue?
>
> A consulting client of mine had the same complaint. He was only able
> to fix it by re-installing Windows. You may want to mention it on
> NTBugTraq, they often discuss and sort out things like this.
>
> ----ScottG.
>

Check out the news groups at Microsoft:

http://communities.microsoft.com/newsgroups/default.asp

In this case, I suggest the "windowsupdate" newsgroup

These news groups are peer-peer support, although MVP's lurk.
If MSDN customer, MS guarantees an answer in 3 days or they will pick it
up.

You can search such newsgroups for answers by going to Google Groups
search.


--
************************************************** *
.~. Jerry Winegarden
/ v \ OIT/Technical Support, Duke University
/( _ )\ jbw@duke.edu, http://www-jerry.oit.duke.edu
^ ^
************************************************** *
T.H. Haymore
19/04/04, 22:15
On Fri, 16 Apr 2004, phaser-X wrote:

> I had a different issue after Wednesdays updates. Two win2k computers in
> my office were rendered useless after the patch. They were fine before,
> but as soon as the patch finished and the PC was rebooted, the CPU usage
> was 100% and nothing could be done. I left both PC's sitting for about 20
> minutes and the 100% CPU usage never came down. Another coworker said he
> had the same issue with his home PC and he was eventually able to get into
> the task manager and noticed that the system process was taking up 99-100%
> of the CPU.


I have run into the same thing with 2K workstations as well as 2K server.
On a side note, an XP 'goof off' box I use will no longer connect to the
online card games or anything else. (Thank goodness for BSD).


>
> Anyone else experience this issue?
>
> -pX




=================================================
Travis
www.cyberabuse.org/crimewatch
Email: Bonk@chatsystems.com | Bonk@cyberabuse.org
=================================================
/"\
\ /
X ASCII Ribbon Campaign
/ \ Against HTML Email
Alex Cruz
19/04/04, 22:25
On Sunday 18 April 2004 09:42 am, plasmahh@informatik.uni-bremen.de wrote:

> > 20 minutes and the 100% CPU usage never came down. Another coworker said
> > he had the same issue with his home PC and he was eventually able to get
> > into the task manager and noticed that the system process was taking up
> > 99-100% of the CPU.

> A similar one.
> When I login to my recently patched box, the start menu and everything on
> the desktop isnt accesible, until I start the task manager and kill a
> process, it does not matter which one...

Question: Are these issues being seen primarily on Windows 2000 Server or
Workstation? Or both?
Brito, Nelson
19/04/04, 23:25
(As usual, and obviously: not speaking on behalf of my employer.)

I didn't see anything unusual, neither with my Win2k nor with my WinXP =
boxes.=20

It'd be a machine specific or something conflicts with some DLL(s).=20

It is usual to replace some DLL(s) when install some program(s).

Cheers.

Nelson Brito

> -----Original Message-----
> From: T.H. Haymore [mailto:bonk@webchat.chatsystems.com]
> Sent: Saturday, April 17, 2004 5:29 AM
> To: bugtraq@securityfocus.com
> Subject: Re: After Ms patches last Wed ...
>=20
>=20
> On Fri, 16 Apr 2004, phaser-X wrote:
>=20
> > I had a different issue after Wednesdays updates. Two=20
> win2k computers in
> > my office were rendered useless after the patch. They were=20
> fine before,
> > but as soon as the patch finished and the PC was rebooted,=20
> the CPU usage
> > was 100% and nothing could be done. I left both PC's=20
> sitting for about 20
> > minutes and the 100% CPU usage never came down. Another=20
> coworker said he
> > had the same issue with his home PC and he was eventually=20
> able to get into
> > the task manager and noticed that the system process was=20
> taking up 99-100%
> > of the CPU.
>=20
>=20
> I have run into the same thing with 2K workstations as well=20
> as 2K server.
> On a side note, an XP 'goof off' box I use will no longer=20
> connect to the
> online card games or anything else. (Thank goodness for BSD).
>=20
>=20
> >
> > Anyone else experience this issue?
> >
> > -pX
>=20
>=20
>=20
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D
> Travis
> www.cyberabuse.org/crimewatch
> Email: Bonk@chatsystems.com | Bonk@cyberabuse.org
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D
> /"\
> \ /
> X ASCII Ribbon Campaign
> / \ Against HTML Email
>=20
>=20
David Hayden
19/04/04, 23:45
Were you able to see what process(es) were driving up CPU usage?
Reinstalling windows probably would fix it but that doesn't tell what is
hanging.


-----Original Message-----
From: Scott Gifford [mailto:sgifford@suspectclass.com]=20
Sent: Saturday, April 17, 2004 1:07 PM
To: phaser-X
Cc: bugtraq@securityfocus.com
Subject: Re: After Ms patches last Wed ...

phaser-X <px@zeroday.net> writes:

> I had a different issue after Wednesdays updates. Two win2k computers
in=20
> my office were rendered useless after the patch. They were fine
before,=20
> but as soon as the patch finished and the PC was rebooted, the CPU
usage=20
> was 100% and nothing could be done. I left both PC's sitting for
about 20=20
> minutes and the 100% CPU usage never came down. Another coworker said
he=20
> had the same issue with his home PC and he was eventually able to get
into=20
> the task manager and noticed that the system process was taking up
99-100%=20
> of the CPU.
>=20
> Anyone else experience this issue?

A consulting client of mine had the same complaint. He was only able
to fix it by re-installing Windows. You may want to mention it on
NTBugTraq, they often discuss and sort out things like this.

----ScottG.
phaser-X
20/04/04, 05:25
I couldn't do anything on the system. If I hit CTRL+ALT+DEL to get into
the task manager, it literally took about 20 minutes. Everything was very
unresponsive. I ended up having to use the "repair" feature off the win2k
CD. It replaced a few files and then the system was fine until I went
back and re-updated, then the PC crashed after about 15 minutes and upon
reboot the system was 100% again. I repeated the "repair" option to get
everything back to normal again. And yes, it was the "system" process
that was 99-100%, not the system idle process.

-pX

On Fri, 16 Apr 2004, Alun Jones wrote:

> phaser-X wrote:
> > I had a different issue after Wednesdays updates. Two win2k
> > computers in my office were rendered useless after the patch.
> > They were fine before, but as soon as the patch finished and
> > the PC was rebooted, the CPU usage was 100% and nothing could
> > be done. I left both PC's sitting for about 20 minutes and
> > the 100% CPU usage never came down. Another coworker said he
> > had the same issue with his home PC and he was eventually
> > able to get into the task manager and noticed that the system
> > process was taking up 99-100% of the CPU.
>
> Not that it's necessarily the case for you, but frequently patching is the
> one time when reboots are almost bound to occur - as a result, an awful lot
> of bugs are discovered after the patch, but not necessarily because of the
> patch. General advice is to try uninstalling the patch and see if the
> problem still exists, before deciding which way to debug - not very easy if
> you have all your CPU locked up!
>
> As to the "system process" taking up 99-100% of the CPU, there is a "System
> Idle Process" that is _supposed_ to do that. I hope your coworker hasn't
> misconstrued :-)
>
> Try calling PSS (you know, tech support?), and see if they have any ideas.
>
> Alun.
> ~~~~
> --
> Texas Imperial Software | Find us at http://www.wftpd.com or email
> 1602 Harvest Moon Place | alun@texis.com.
> Cedar Park TX 78613-1419 | WFTPD, WFTPD Pro are Windows FTP servers.
> Fax/Voice +1(512)258-9858 | Try our NEW client software, WFTPD Explorer.
>
>
geoff.froh@densho.org
20/04/04, 11:45
> I was told a Win2K user at work experienced the same thing. Seems that=

> Microsoft may not have spent enough time testing one of these patches o=
n the
> Win2K platform. Dunno which one, since in recent years I'd found
> Microsoft's patches to be well-tested enough that I haven't made a poin=
t to
> apply them only one at a time so I could identify faulty ones, as I fou=
nd it
> necessary to do in past years.

I had neither one of the issues mentioned in this thread; but did have a =
single workstation (out of about 25) start spewing windows file protectio=
n error messages for almost every system file. The disturbing thing was t=
hat even after the box had access to the installation media (which wfp us=
es to roll back to the original file), the errors just kept coming. In th=
e event log, the service was writing more error messages saying that the =
file could not be replaced because the signatures didn't match.

I'm planning on reinstalling; but didn't have time this week so I disable=
d wfp by hex editing sfp.dll to turn the damn thing off. (Incidentally, I=
*love* windoze services that you can't control. That way I can't acciden=
tally hurt myself. Thanks MS!)

The machine is SP4 fully patched with virusscan fully updated. I did some=
additional security auditing and didn't find anything strange. Everythin=
g started going to hell after applying the latest patches.

Anyone else?

Geoff Froh
Technical Manager

Densho
1416 S. Jackson St.
Seattle, WA 98144
US
(v) 1.206.320.0095
(f) 1.206.320.0098
(e) geoff.froh@densho.org
(w) www.densho.org
Greg Kujawa
21/04/04, 04:25
In-Reply-To: <2DF52978DE0D854F9435C7AA7DD51F9801F4A12D@atlmaiexc p01.iss.local>

Don't know if this is duplicate info from another message, but there are two different issues with the KB835732 update. Specifically on Windows 2000 machines.

The first issue involves cached data in RAM. If a machine is rebooted immediately after applying the update there is a chance that the BSOD will come up. The STOP error is described as DRIVER_IRQ_NOT_LESS_OR_EQUAL. A hard reboot will eliminate this transi
ent error.

The second issue involves problems with the IPSec Policy Agent Service. This is enabled to start automatically with the update and it can lead to the CPU pegging. Stopping the service and disabling it will elimiate this issue.

Can't say that Microsoft can claim these issues were the result of updates being rushed to market. Most of the vulnerabilities were brought to their attention 6 months ago. At least the issues aren't as bad as Windows NT 4.0 Service Pack 6. That broke the
TCP/IP stack and really had me scrambling back then resuscitating my servers!

>Received: (qmail 25226 invoked from network); 19 Apr 2004 18:05:58 -0000
>Received: from outgoing3.securityfocus.com (HELO outgoing.securityfocus.com) (205.206.231.27)
> by mail.securityfocus.com with SMTP; 19 Apr 2004 18:05:58 -0000
>Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
> by outgoing.securityfocus.com (Postfix) with QMQP
> id 6453B236FE4; Mon, 19 Apr 2004 19:36:44 -0600 (MDT)
>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>Received: (qmail 29580 invoked from network); 19 Apr 2004 11:30:38 -0000
>X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1
>content-class: urn:content-classes:message
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="iso-8859-1"
>Content-Transfer-Encoding: quoted-printable
>Subject: RE: After Ms patches last Wed ...
>Date: Mon, 19 Apr 2004 13:33:53 -0400
>Message-ID: <2DF52978DE0D854F9435C7AA7DD51F9801F4A12D@atlmaiexc p01.iss.local>
>X-MS-Has-Attach:
>X-MS-TNEF-Correlator:
>Thread-Topic: After Ms patches last Wed ...
>Thread-Index: AcQmMmxSjtFxm8gHTOi27BhiHtRdWQAASwgw
>From: "Brito, Nelson (ISS Brazil)" <NBrito@iss.net>
>To: "T.H. Haymore" <bonk@webchat.chatsystems.com>,
> <bugtraq@securityfocus.com>
>X-OriginalArrivalTime: 19 Apr 2004 17:33:54.0535 (UTC) FILETIME=[7CB10F70:01C42634]
>
>(As usual, and obviously: not speaking on behalf of my employer.)
>
>I didn't see anything unusual, neither with my Win2k nor with my WinXP =
>boxes.=20
>
>It'd be a machine specific or something conflicts with some DLL(s).=20
>
>It is usual to replace some DLL(s) when install some program(s).
>
>Cheers.
>
>Nelson Brito
>
>> -----Original Message-----
>> From: T.H. Haymore [mailto:bonk@webchat.chatsystems.com]
>> Sent: Saturday, April 17, 2004 5:29 AM
>> To: bugtraq@securityfocus.com
>> Subject: Re: After Ms patches last Wed ...
>>=20
>>=20
>> On Fri, 16 Apr 2004, phaser-X wrote:
>>=20
>> > I had a different issue after Wednesdays updates. Two=20
>> win2k computers in
>> > my office were rendered useless after the patch. They were=20
>> fine before,
>> > but as soon as the patch finished and the PC was rebooted,=20
>> the CPU usage
>> > was 100% and nothing could be done. I left both PC's=20
>> sitting for about 20
>> > minutes and the 100% CPU usage never came down. Another=20
>> coworker said he
>> > had the same issue with his home PC and he was eventually=20
>> able to get into
>> > the task manager and noticed that the system process was=20
>> taking up 99-100%
>> > of the CPU.
>>=20
>>=20
>> I have run into the same thing with 2K workstations as well=20
>> as 2K server.
>> On a side note, an XP 'goof off' box I use will no longer=20
>> connect to the
>> online card games or anything else. (Thank goodness for BSD).
>>=20
>>=20
>> >
>> > Anyone else experience this issue?
>> >
>> > -pX
>>=20
>>=20
>>=20
>>=20
>> =
>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D
>> Travis
>> www.cyberabuse.org/crimewatch
>> Email: Bonk@chatsystems.com | Bonk@cyberabuse.org
>> =
>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D
>> /"> \ /
>> X ASCII Ribbon Campaign
>> / \ Against HTML Email
>>=20
>>=20
>
David Hayden
01/05/04, 02:05
For those of you that had problems with the MS Patch...

Microsoft (Quote, Chart) confirmed that disruptive bugs in a recently
issued Windows security patch could cause systems to freeze or lead to
system usage overload.

The buggy patch, issued earlier this month to plug numerous "critical"
vulnerabilities in the Windows operating system, has caused problems for
IT admins because of conflicts with installed drivers.

"[It] causes Microsoft Windows 2000 to try repeatedly to load drivers
that do not load successfully," the software giant said Wednesday,
identifying the drivers as Ipsecw2k.sys, Imcide.sys and Dlttape.sys...

http://www.internetnews.com/dev-news/article.php/3347221

DH


-----Original Message-----
From: Greg Kujawa [mailto:greg.kujawa@diamondcellar.com]=20
Sent: Tuesday, April 20, 2004 3:40 PM
To: bugtraq@securityfocus.com
Subject: Re: After Ms patches last Wed ...

In-Reply-To:
<2DF52978DE0D854F9435C7AA7DD51F9801F4A12D@atlmaiexc p01.iss.local>

Don't know if this is duplicate info from another message, but there are
two different issues with the KB835732 update. Specifically on Windows
2000 machines.=20



The first issue involves cached data in RAM. If a machine is rebooted
immediately after applying the update there is a chance that the BSOD
will come up. The STOP error is described as
DRIVER_IRQ_NOT_LESS_OR_EQUAL. A hard reboot will eliminate this
transient error.



The second issue involves problems with the IPSec Policy Agent Service.
This is enabled to start automatically with the update and it can lead
to the CPU pegging. Stopping the service and disabling it will elimiate
this issue.



Can't say that Microsoft can claim these issues were the result of
updates being rushed to market. Most of the vulnerabilities were brought
to their attention 6 months ago. At least the issues aren't as bad as
Windows NT 4.0 Service Pack 6. That broke the TCP/IP stack and really
had me scrambling back then resuscitating my servers!



>Received: (qmail 25226 invoked from network); 19 Apr 2004 18:05:58=20
>-0000

>Received: from outgoing3.securityfocus.com (HELO=20
>outgoing.securityfocus.com) (205.206.231.27)

> by mail.securityfocus.com with SMTP; 19 Apr 2004 18:05:58 -0000

>Received: from lists2.securityfocus.com (lists2.securityfocus.com=20
>[205.206.231.20])

> by outgoing.securityfocus.com (Postfix) with QMQP

> id 6453B236FE4; Mon, 19 Apr 2004 19:36:44 -0600 (MDT)

>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm

>Precedence: bulk

>List-Id: <bugtraq.list-id.securityfocus.com>

>List-Post: <mailto:bugtraq@securityfocus.com>

>List-Help: <mailto:bugtraq-help@securityfocus.com>

>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>

>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>

>Delivered-To: mailing list bugtraq@securityfocus.com

>Delivered-To: moderator for bugtraq@securityfocus.com

>Received: (qmail 29580 invoked from network); 19 Apr 2004 11:30:38=20
>-0000

>X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1

>content-class: urn:content-classes:message

>MIME-Version: 1.0

>Content-Type: text/plain;

> charset=3D"iso-8859-1"

>Content-Transfer-Encoding: quoted-printable

>Subject: RE: After Ms patches last Wed ...

>Date: Mon, 19 Apr 2004 13:33:53 -0400

>Message-ID:=20
><2DF52978DE0D854F9435C7AA7DD51F9801F4A12D@atlmaiexc p01.iss.local>

>X-MS-Has-Attach:=20

>X-MS-TNEF-Correlator:=20

>Thread-Topic: After Ms patches last Wed ...

>Thread-Index: AcQmMmxSjtFxm8gHTOi27BhiHtRdWQAASwgw

>From: "Brito, Nelson (ISS Brazil)" <NBrito@iss.net>

>To: "T.H. Haymore" <bonk@webchat.chatsystems.com>,

> <bugtraq@securityfocus.com>

>X-OriginalArrivalTime: 19 Apr 2004 17:33:54.0535 (UTC)=20
>FILETIME=3D[7CB10F70:01C42634]

>

>(As usual, and obviously: not speaking on behalf of my employer.)

>

>I didn't see anything unusual, neither with my Win2k nor with my WinXP=20
>=3D

>boxes.=3D20

>

>It'd be a machine specific or something conflicts with some =
DLL(s).=3D20

>

>It is usual to replace some DLL(s) when install some program(s).

>

>Cheers.

>

>Nelson Brito

>

>> -----Original Message-----

>> From: T.H. Haymore [mailto:bonk@webchat.chatsystems.com]

>> Sent: Saturday, April 17, 2004 5:29 AM

>> To: bugtraq@securityfocus.com

>> Subject: Re: After Ms patches last Wed ...

>>=3D20

>>=3D20

>> On Fri, 16 Apr 2004, phaser-X wrote:

>>=3D20

>> > I had a different issue after Wednesdays updates. Two=3D20

>> win2k computers in

>> > my office were rendered useless after the patch. They were=3D20

>> fine before,

>> > but as soon as the patch finished and the PC was rebooted,=3D20

>> the CPU usage

>> > was 100% and nothing could be done. I left both PC's=3D20

>> sitting for about 20

>> > minutes and the 100% CPU usage never came down. Another=3D20

>> coworker said he

>> > had the same issue with his home PC and he was eventually=3D20

>> able to get into

>> > the task manager and noticed that the system process was=3D20

>> taking up 99-100%

>> > of the CPU.

>>=3D20

>>=3D20

>> I have run into the same thing with 2K workstations as well=3D20

>> as 2K server.

>> On a side note, an XP 'goof off' box I use will no longer=3D20

>> connect to the

>> online card games or anything else. (Thank goodness for BSD).

>>=3D20

>>=3D20

>> >

>> > Anyone else experience this issue?

>> >

>> > -pX

>>=3D20

>>=3D20

>>=3D20

>>=3D20

>> =3D

>=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D =3D3D=3D3D=3D3D=3D3D=3D=
3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3
>D=3D3D=3D

>=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D =3D3D=3D3D=3D3D=3D3D=3D=
3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3
>D

>> Travis

>> www.cyberabuse.org/crimewatch

>> Email: Bonk@chatsystems.com | Bonk@cyberabuse.org

>> =3D

>=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D =3D3D=3D3D=3D3D=3D3D=3D=
3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3
>D=3D3D=3D

>=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D =3D3D=3D3D=3D3D=3D3D=3D=
3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3
>D

>> /"> \ /

>> X ASCII Ribbon Campaign

>> / \ Against HTML Email

>>=3D20

>>=3D20

>
InfoSec@seba.com
03/05/04, 19:25
I've been following this thread and the stated instabilities of the
MS04-011 security update, I had determined to delay deployment of this
patch until it was stabilized but it seems it wasnt stabilized fast enough
to beat the worms to market.

Now of course this same LSASS vuln addressed by MS04-011 is the target of
the Sasser worm....

undeployable/unstable patch + critical vulnerability = the even greater
threat of the sasser worm(s)... good job.

I read in a article on this patch that the instability is only present if
the "Nortel Networks VPN client is installed and the IPSec Policy Agent is
set to manual or automatic startup type", does anyone have any further
input on MS04-011? Stable on a standard Win2k server install or not?

Thanks,
Michael





"David Hayden" <dahayden@clubhayden.com>
04/30/2004 01:36 PM

To: "Greg Kujawa" <greg.kujawa@diamondcellar.com>,
<bugtraq@securityfocus.com>, "Michael Ooi" <michael@imr.com.sg>,
"phaser-X" <px@zeroday.net>, "T.H. Haymore"
<bonk@webchat.chatsystems.com>, <plasmahh@informatik.uni-bremen.de>, "Andy
Shaw" <andy@east.no>, <aborg@mca.org.mt>
cc:
Subject: RE: After Ms patches last Wed ...


For those of you that had problems with the MS Patch...

Microsoft (Quote, Chart) confirmed that disruptive bugs in a recently
issued Windows security patch could cause systems to freeze or lead to
system usage overload.

The buggy patch, issued earlier this month to plug numerous "critical"
vulnerabilities in the Windows operating system, has caused problems for
IT admins because of conflicts with installed drivers.

"[It] causes Microsoft Windows 2000 to try repeatedly to load drivers
that do not load successfully," the software giant said Wednesday,
identifying the drivers as Ipsecw2k.sys, Imcide.sys and Dlttape.sys...

http://www.internetnews.com/dev-news/article.php/3347221

DH


-----Original Message-----
From: Greg Kujawa [mailto:greg.kujawa@diamondcellar.com]
Sent: Tuesday, April 20, 2004 3:40 PM
To: bugtraq@securityfocus.com
Subject: Re: After Ms patches last Wed ...

In-Reply-To:
<2DF52978DE0D854F9435C7AA7DD51F9801F4A12D@atlmaiexc p01.iss.local>

Don't know if this is duplicate info from another message, but there are
two different issues with the KB835732 update. Specifically on Windows
2000 machines.



The first issue involves cached data in RAM. If a machine is rebooted
immediately after applying the update there is a chance that the BSOD
will come up. The STOP error is described as
DRIVER_IRQ_NOT_LESS_OR_EQUAL. A hard reboot will eliminate this
transient error.



The second issue involves problems with the IPSec Policy Agent Service.
This is enabled to start automatically with the update and it can lead
to the CPU pegging. Stopping the service and disabling it will elimiate
this issue.



Can't say that Microsoft can claim these issues were the result of
updates being rushed to market. Most of the vulnerabilities were brought
to their attention 6 months ago. At least the issues aren't as bad as
Windows NT 4.0 Service Pack 6. That broke the TCP/IP stack and really
had me scrambling back then resuscitating my servers!



>Received: (qmail 25226 invoked from network); 19 Apr 2004 18:05:58
>-0000

>Received: from outgoing3.securityfocus.com (HELO
>outgoing.securityfocus.com) (205.206.231.27)

> by mail.securityfocus.com with SMTP; 19 Apr 2004 18:05:58 -0000

>Received: from lists2.securityfocus.com (lists2.securityfocus.com
>[205.206.231.20])

> by outgoing.securityfocus.com (Postfix) with QMQP

> id 6453B236FE4; Mon, 19 Apr 2004 19:36:44 -0600 (MDT)

>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm

>Precedence: bulk

>List-Id: <bugtraq.list-id.securityfocus.com>

>List-Post: <mailto:bugtraq@securityfocus.com>

>List-Help: <mailto:bugtraq-help@securityfocus.com>

>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>

>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>

>Delivered-To: mailing list bugtraq@securityfocus.com

>Delivered-To: moderator for bugtraq@securityfocus.com

>Received: (qmail 29580 invoked from network); 19 Apr 2004 11:30:38
>-0000

>X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1

>content-class: urn:content-classes:message

>MIME-Version: 1.0

>Content-Type: text/plain;

> charset="iso-8859-1"

>Content-Transfer-Encoding: quoted-printable

>Subject: RE: After Ms patches last Wed ...

>Date: Mon, 19 Apr 2004 13:33:53 -0400

>Message-ID:
><2DF52978DE0D854F9435C7AA7DD51F9801F4A12D@atlmaiexc p01.iss.local>

>X-MS-Has-Attach:

>X-MS-TNEF-Correlator:

>Thread-Topic: After Ms patches last Wed ...

>Thread-Index: AcQmMmxSjtFxm8gHTOi27BhiHtRdWQAASwgw

>From: "Brito, Nelson (ISS Brazil)" <NBrito@iss.net>

>To: "T.H. Haymore" <bonk@webchat.chatsystems.com>,

> <bugtraq@securityfocus.com>

>X-OriginalArrivalTime: 19 Apr 2004 17:33:54.0535 (UTC)
>FILETIME=[7CB10F70:01C42634]

>

>(As usual, and obviously: not speaking on behalf of my employer.)

>

>I didn't see anything unusual, neither with my Win2k nor with my WinXP
>=

>boxes.=20

>

>It'd be a machine specific or something conflicts with some DLL(s).=20

>

>It is usual to replace some DLL(s) when install some program(s).

>

>Cheers.

>

>Nelson Brito

>

>> -----Original Message-----

>> From: T.H. Haymore [mailto:bonk@webchat.chatsystems.com]

>> Sent: Saturday, April 17, 2004 5:29 AM

>> To: bugtraq@securityfocus.com

>> Subject: Re: After Ms patches last Wed ...

>>=20

>>=20

>> On Fri, 16 Apr 2004, phaser-X wrote:

>>=20

>> > I had a different issue after Wednesdays updates. Two=20

>> win2k computers in

>> > my office were rendered useless after the patch. They were=20

>> fine before,

>> > but as soon as the patch finished and the PC was rebooted,=20

>> the CPU usage

>> > was 100% and nothing could be done. I left both PC's=20

>> sitting for about 20

>> > minutes and the 100% CPU usage never came down. Another=20

>> coworker said he

>> > had the same issue with his home PC and he was eventually=20

>> able to get into

>> > the task manager and noticed that the system process was=20

>> taking up 99-100%

>> > of the CPU.

>>=20

>>=20

>> I have run into the same thing with 2K workstations as well=20

>> as 2K server.

>> On a side note, an XP 'goof off' box I use will no longer=20

>> connect to the

>> online card games or anything else. (Thank goodness for BSD).

>>=20

>>=20

>> >

>> > Anyone else experience this issue?

>> >

>> > -pX

>>=20

>>=20

>>=20

>>=20

>> =

>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3
>D=3D=

>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3
>D

>> Travis

>> www.cyberabuse.org/crimewatch

>> Email: Bonk@chatsystems.com | Bonk@cyberabuse.org

>> =

>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3
>D=3D=

>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3
>D

>> /"> \ /

>> X ASCII Ribbon Campaign

>> / \ Against HTML Email

>>=20

>>=20

>
James Riden
04/05/04, 00:25
InfoSec@seba.com writes:

> I've been following this thread and the stated instabilities of the
> MS04-011 security update, I had determined to delay deployment of this
> patch until it was stabilized but it seems it wasnt stabilized fast enough
> to beat the worms to market.
>
> Now of course this same LSASS vuln addressed by MS04-011 is the target of
> the Sasser worm....
>
> undeployable/unstable patch + critical vulnerability = the even greater
> threat of the sasser worm(s)... good job.
>
> I read in a article on this patch that the instability is only present if
> the "Nortel Networks VPN client is installed and the IPSec Policy Agent is
> set to manual or automatic startup type", does anyone have any further
> input on MS04-011? Stable on a standard Win2k server install or not?

We've just seen issues with some USB storage devices after applying
MS04-011. No good details yet I'm afraid, but you might want to test
the patch on a few machines first.

It's been stable on all the servers (just over 100) I've applied it
to.

cheers,
Jamie
--
James Riden / j.riden@massey.ac.nz / Systems Security Engineer
GPG public key available at: http://www.massey.ac.nz/~jriden/
This post does not necessarily represent the views of my employer.
Nicholas Weaver
04/05/04, 21:15
This brings the question: Are Mondo-sized patches like
MS04-011 a good idea or a bad idea?


On the one hand, they correct a lot of problems, in a way very
friendly to most users. One of the big headaches is the ignorant
users, who end up worm-bait, botnets, spam relays, stepping stones,
etc. Allowing them to easily be up to date is a good thing.

Additionally, it removes some of the judgement calls on patch
severity/urgency, because there is probabyl going to be at least one
"you better patch it now", so there is less likely to be an "Microsoft
only rates this as important because you have to be authenticated in
the domain..." moment.


But on the other hand, the probability of the superpatch
causing problems is exacerbated. If each normal patch has a
probability P of causing problems, then an N-fold patch has
probability (1 - P)^N of NOT causing a problem. Thus the probability
is 1 - (1 - P)^N that the N-way patch will have an issue.

For real-world numbers, if P = .1 (10% chance the patch may be
problematic) and N is 10, then the patch has a 65% chance of being a
problem. Even if P is .01, there is still a nearly 10% chance of
problems from a 10-way superpatch.


This is now worse as the attackers have finally started waking
up to the reality of worms. With vulnerabilities like the ones in the
superpatch, and with attackers demonstrating a <48 hour turnaround
time between disclosure and worm (Witty) or exploit and worm (Sasser),
these superpatches leave an adminitrator in a bind: Apply the
superpatch immeditely and accept the significantly increased
probability of failure, or don't apply the patch and accept the vastly
high probability of a worm in the near future.


--
Nicholas C. Weaver nweaver@cs.berkeley.edu
Nick FitzGerald
04/05/04, 22:15
InfoSec@seba.com wrote:

> I read in a article on this patch that the instability is only present if
> the "Nortel Networks VPN client is installed and the IPSec Policy Agent is
> set to manual or automatic startup type", does anyone have any further
> input on MS04-011? Stable on a standard Win2k server install or not?

I suspect you mis-read, or the article was badly written/edited. That
combination _is_ specifically mentioned by Microsoft as a configuration
known to exhibit problems post-MS04-011:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;841382

However, my reading of that KB article is not that that is the only
configuration that may cause trouble. In particular:

Note This problem may occur if other drivers or services do not
load successfully. This workaround is specific to the Nortel
Networks VPN client drivers.

Also, as the hotfix that is now available to address this issue
replaces these core files:

Mountmgr.sys
Ntkrnlmp.exe
Ntkrnlpa.exe
Ntkrpamp.exe
Ntoskrnl.exe

it seems quite unlikely that this problem would be specific to just one
common VPN client configuration...


Regards,

Nick FitzGerald