Microsoft Patch Causing Lockups, Crashes
MS06-015 is one of five patches Microsoft released Tuesday to correct, among other things, a "critical" Windows Explorer vulnerability that hackers could use to execute code remotely.
But that security patch contains a new file — named Verclsid.exe — that conflicts with Hewlett-Packard printers, scanners and cameras, one Microsoft security official acknowledged on Microsoft's online technical support site.
"We've determined that the majority of the issues people are having with MS06-015/KB908531 are due to a bad interaction between the security update and a software component included with various HP hardware devices, including but not limited to printers, scanners and cameras," wrote Steven Hui, a Microsoft spokesperson on TechNet who fielded questions Thursday from numerous irritated customers and IT administrators on its online technical help site.
A myriad of users flocked to Microsoft's online technical support site for help late this week regarding numerous problems including systems IE lockups that occurred after installing the MS06-015 patch. The issues did not clear up even after rebooting, some said.
Some claimed the issues were not isolated to systems connected to HP hardware.
In many cases, the problem required users and partners to uninstall the patch or perform system restores to get systems back up and running.
"Customers are reporting that IE stops working and numerous instances of Verclsid.exe show up,'" said Brian Bergin, president of Terabyte Computers. "To fix yet another security issue with IE, [Microsoft] has Verclsid.exe they've introduced but obviously didn't test."
"If you right click on the desktop now it freezes," said another source, who asked not to be named.
Microsoft's Hui suggested customers modify the registry or shut down the hardware process to avoid the conflict, but later noted that the second option would only work for users currently logged-in.
It remains unclear how widespread the problem is for business users and consumers that downloaded the security update.
At least four Microsoft solution providers contacted by CRN could not identify any problems in their user bases. One security ISV close to Microsoft speculated that the problems may be traced back to the non-security changes made to the ActiveX controls in the IE cumulative patch [MS06-013], but he could not confirm that.
Microsoft did not comment on this story as of press time. As the software giant investigates the problem, however, some customers have taken Microsoft's initial advice and some have come up with their own workarounds.
On the TechNet Web site, for example, one user suggested simply renaming the "Verclsid.exe" file before installation to prevent problems.
Microsoft said the Verclsid.exe file in MS06-015 is used to verify a COM object before it is instantiated by Windows Explorer. The security patch is for Windows 2000 SP4, Windows XP, Windows Server 2003.
Yet another user suggested turning off all processes using the Windows Task Manager or the Auto Update (AU) process altogether and waiting a week before installing patches.
Microsoft disagreed with that suggestion and said it is important to re-install MS06-015 because it fixes a critical security vulnerability, and pointed out that disabling Auto Update leaves computers unprotected.
One solution provider said he is following that advice but noted that some customers are thinking about shutting off Microsoft's Auto Update feature to prevent downloading security patches that disable their systems.
"We're recommending they leave AU enabled but they're understandably frustrated. For some customers this is the second time in the past year an update from Microsoft has left them unable to work," said Terabyte's Bergin. "Some have said they're done with Auto Updates and want it disabled to let others beta test Microsoft fixes before they install them.