Potential Problems with MS05-019

FYI…

- http://isc.sans.org/diary.php?date=2005-04-22
Updated April 22nd 2005 20:52 UTC
"We are hearing of some problems with the MS05-019 patch… http://archives.neohapsis.com/archives/ntb…05-q2/0049.html
"After installing the update in Microsoft Security Bulletin MS05-019 on two servers at a customer site, we are no longer able to connect via VPN to terminal services on those servers. (Other servers that did not have the security bulletins from last Tuesday installed can connect via VPN.) After many hours over two days working with Microsoft Product Support Services, we discovered that forcing the MTU size down allowed the client to connect to terminal services. Today Microsoft PSS reported that they have confirmed that there is a problem with ICMP messages being incorrectly discarded (other have opened PSS cases about this issue). This could be why the MTU size is not being set correctly.
There will be an update to the patch in MS05-019, but as of this time, that update is not available. A Microsoft KB article is being written and has been assigned the number KB898060, but as to this time, that article is not publicly available…"

"There is also discussion that it doesn't affect all operating systems…
- http://marc.theaimsgroup.com/?l=patchmanag…=1&b;=200504&w;=2
- http://www.winserverhelp.com/ftopic22712.html …"

…Link is active - today's date:
Network connectivity between clients and servers may not work after the installation of security update MS05-019 or Windows Server 2003 Service Pack 1
- http://support.microsoft.com/default.aspx?scid=898060
"…RESOLUTION
Hotfix information
A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Only apply it to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.
To resolve this problem immediately, contact Microsoft Product Support Services to obtain the hotfix…"


Hmmm…

FYI…

Update on Problem with MS05-019
- http://isc.sans.org/diary.php?date=2005-04-23
Updated April 24th 2005 03:40 UTC
"…Yesterday, we mentioned in our diary that there may be network connectivity problems when applying the MS05-019 patch. Microsoft has published an article revealing that network connectivity between clients and servers may fail when applying MS05-019 patch or Windows Server 2003 Service Pack 1. Accordingly to the article, the following symptoms may occur:

* Inability to connect to terminal servers or to file share access.
* Failure of domain controller replication across WAN links.
* Microsoft Exchange servers cannot connect to domain controllers.

If you experience similar issues, you may want to check out the article at:

http://support.microsoft.com/default.aspx?scid=898060 …"

FYI…

- http://support.microsoft.com/default.aspx?scid=898060
Article ID: 898060
Last Review: April 26, 2005
Revision: 2.0 …

APPLIES TO
• Microsoft Windows 2000 Advanced Server SP3
• Microsoft Windows 2000 Advanced Server SP4
• Microsoft Windows 2000 Service Pack 3
• Microsoft Windows 2000 Datacenter Server SP4
• Microsoft Windows 2000 Service Pack 3
• Microsoft Windows 2000 Professional SP4
• Microsoft Windows 2000 Service Pack 3
• Microsoft Windows 2000 Server SP4
• Microsoft Windows XP Professional 64-Bit Edition (Itanium) 2003
• Microsoft Windows XP Home Edition SP1
• Microsoft Windows XP Home Edition SP2
• Microsoft Windows XP Professional SP1
• Microsoft Windows XP Professional SP2
• Microsoft Windows Server 2003, Datacenter Edition
• Microsoft Windows Server 2003, Enterprise Edition
• Microsoft Windows Server 2003, Standard Edition
• Microsoft Windows Server 2003, Web Edition
• Microsoft Windows Server 2003, Datacenter Edition for Itanium-based Systems
• Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems …"

Arrgghh…now up to "Revision: 4.0"
- http://support.microsoft.com/default.aspx?scid=898060
Last Review: May 5, 2005
Revision: 4.0 …

(Related)
- http://support.microsoft.com/kb/893066
Last Review: April 25, 2005
Revision: 4.1 …
…Known issues:
- http://support.microsoft.com/kb/890345/
Last Review: April 13, 2005
Revision: 2.0
- http://support.microsoft.com/kb/896350/
Last Review: April 27, 2005
Revision: 3.0
- http://support.microsoft.com/kb/897656/
Last Review: April 19, 2005
Revision: 1.1 …"

Ugh.

They're Baaaaaaaaaaaaaack….
- http://isc.sans.org/diary.php?date=2005-05-11
Updated May 11th 2005 22:24 UTC
"Rumor has it that Microsoft will re-release the MS05-019 security update in June, 2005 correcting their removal of raw sockets…"

FYI…

'Was "rumor" ( http://isc.sans.org/diary.php?date=2005-05-11 ), now "fact":

Microsoft Security Advisory (899480)
- http://www.microsoft.com/technet/security/…ory/899480.mspx
Vulnerability in TCP Could Allow Connection Reset
Published: May 18, 2005
"…Customers should note that the MS05-019 security bulletin is currently scheduled to be re-released in June of 2005…"

"Re-release":

Vulnerabilities in TCP/IP Could Allow Remote Code Execution and Denial of Service (893066) - MS05-019 Critical
- http://www.microsoft.com/technet/security/…n/MS05-019.mspx
• V2.0 (June 14, 2005): Microsoft updated this bulletin today to advise customers that a revised version of the security update is available. We recommend installing this revised security update even if you have installed the previous version. The revised security update will be available through Windows Update, Software Update Services (SUS), and will be recommended by the Microsoft Baseline Security Analyzer (MBSA).