- http://isc.sans.org/diary.php?date=2004-08-10
Updated August 10th 2004 22:07 UTC
"Windows XP Service Pack 2 was officially released to the world yesterday…While most users should not have significant problems with SP2, others stumble upon cases where home grown web applications or other 3rd party software may not work properly after installation. The Internet Storm Center has set up a forum to collect the experiences of others in the security community. It is the hope of the ISC that users will be able to share information on problems they have encountered and/or steps they used to help remedy these issues. If you would like to submit your experiences, please see the following URL…"
"Programs that may behave differently in Windows XP Service Pack 2"
- http://support.microsoft.com/default.aspx?…ct=windowsxpsp2
8/10/2004
"XP Service Pack 2 (SP2) introduces a number of new features that help increase the performance and the security of your system. These changes also affect the operations and functionality of some programs…"
M$ To Release WinXP/SP2 To Home Users 08.18.2004…about 80MB size
- http://finance.myway.com/jsp/nw/nwdt_rt.js…7&date=20040817
Tuesday August 17, 6:43 AM EDT
"Microsoft told BBC News Online its SP2 security patch will be put on servers that automatically update home PCs as from Wednesday. The consumer version is smaller than the business edition released to corporate customers…For consumers, SP2 is expected to be about 80 megabytes but it could vary in size depending on how up to date with patches a user's machine is. Microsoft hopes to get SP2 on to 100 million machines in the next couple of months. By the end of the month users of XP Professional will get a version tailored for them. Early reports suggest that SP2 can cause problems…"
Microsoft Delays SP2 Auto Update For Enterprises
- http://www.techweb.com/wire/story/TWB20040817S0003
TechWeb News - August 17, 2004 (1:34 p.m. EST)
"Although Monday was to be the day when Microsoft began pushing Windows XP Service Pack 2 (SP2) to enterprises, it changed its mind at the last minute and delayed the automatic updating for more than a week…Users of Windows XP Home Edition, however, who have enabled Automatic Update will begin to receive SP2 Wednesday, August 18. The delay likely won't bother many businesses, who are busy testing the upgrade before rolling it out to desktops. Analysts have generally recommended caution on SP2 as well. Last week, for instance, Gartner analysts advised enterprises to wait at least two months before deploying the OS update."
WinXP/SP2 Home Available On AutoUpdate Aug. 18
- http://www.crn.com/showArticle.jhtml?artic…bleArticle=true
"…Nortec recommends that businesses test Windows XP Service Pack 2 as soon as it is available and plan a rapid deployment. Prior Microsoft updates have been reverse-engineered, and within as little as 20 days, exploits were available and used to attack unpatched systems. While Windows XP Service Pack 2 may cause compatibility trouble, it appears that most of that trouble will be with home systems."
New Download.Ject Attack Serves Up Porn
- http://www.securitypipeline.com/showArticl…bleArticle=true
August 20, 2004
"A new version of June's Download.Ject attack is hitting users through a pair of instant messaging services, planting backdoors on fully-patched Windows XP PCs, and serving victims with a diet of porn ads. According to Thor Larholm, a senior security researcher at Newport Beach, Calif.-based PivX Solutions, the new attack is probably the work of the same group of hackers who launched the original Download.Ject assault in June…This attack, said Larholm, is different. "The attacks comes in via AIM or ICQ instant messages, either from random users or users you may know," he said. If the users clicks on the link that reads "My personal home page http://XXXXXXX.X-XXXXXX.XXX/" the server attempts to download the Trojan using several IE vulnerabilities, including Object Data, Ibiza CHM, and MHTML Redirect, he added…Larholm said that a fully-patched edition of Internet Explorer 6 running on Windows XP SP1 can be compromised by this newest attack, but that machines which have been updated with Windows XP Service Pack 2 (SP2) are safe…"
More Vendors Report SP2 Woes
- http://www.crn.com/showArticle.jhtml?artic…9&flatPage=true
Aug. 20, 2004
"Glitches between Windows XP Service Pack 2 and critical applications continue to emerge…McAfee…Symantec…Groove Networks…SonicWall…"
* Microsoft Windows XP Professional Service Pack 2 (SP2)
* Microsoft Windows XP Home Edition Service Pack 2 (SP2)
* Microsoft Windows XP Media Center Edition Service Pack 2 (SP2)
* Microsoft Windows XP Tablet PC Edition 2005
Some programs seem to stop working after you install WinXP SP2
- http://support.microsoft.com/default.aspx?scid=kb;[LN];842242
(Sorry…do copy/paste on above URL ^^^ , as board software is a bit short)
"…applies to:
* Microsoft Windows XP Professional Service Pack 2 (SP2)
* Microsoft Windows XP Home Edition Service Pack 2 (SP2)
>>> Last Reviewed: 8/23/2004 (4.0) …"
IT Admins Not 'Trusting' SP2 Security
- http://www.eweek.com/article2/0,1759,1638441,00.asp
August 23, 2004
"More than two years after company officials claimed Microsoft Corp. would emphasize security over features in all products, the whopping update to the company's Windows XP operating system is being hit for introducing new vulnerabilities. IT administrators and security experts who have had a chance to install, work with and investigate the changes Windows XP Service Pack 2 makes to the operating system said last week the upgrade doesn't live up to the spirit of Microsoft's Trustworthy Computing campaign announced by Chairman and Chief Software Architect Bill Gates in January 2002. Within about a week of its limited release two weeks ago, a German security researcher found two issues with SP2 that changed the way Microsoft products typically warn users about dangerous online content…ZoneID changes are not experts' only SP2 concerns. One of the added features of SP2 is a default installation of the IIS (Internet Information Services) Web server package, which includes an HTTP server and an SMTP server. Although IIS—which is not known for its security—is not enabled by default, the fact that it is installed as part of a security update worries many in the security community…"
FYI…maybe by the time we get this, it'll be on "Rev 2":
XP SP2 on 'FREE' CD - order Online from M$
- http://www.desktoppipeline.com/showArticle…icleID=32900008
August 25, 2004
"… The installation, which requires 1.6GB of available hard disk space, was previously only available in a 75MB download (for individual PCs; the full "Network Install" version is 266MB). This could be time-consuming for most XP users, and nearly impossible for those consumers still using dial-up connections to access the Internet. According to the site, the CD, which is available free of charge, will take about 4-6 weeks to reach those users who request it. As of August 25th, it was available in English and German; versions in 25 different languages will be available within another two months."
Although the forum below is only one vendor, it stands to reason that the XP/SP2 install experience runs along the same lines for the average user of all hardware vendors. Good info:
PC makers: Look before taking SP2 leap
- http://news.com.com/2102-1016_3-5343593.ht…g=st.util.print
September 2, 2004
" Although Microsoft has recommended consumers turn on Windows' Automatic Update feature to get Windows XP Service Pack 2, PC makers are reminding Windows XP users to do their homework before installing the security update…Many PC makers have a list of revised drivers and patches that should be installed before downloading the OS update…For example, Dell…HP…Sony…"
