Risk
9/12/2013
02:37 PM
Connect Directly
RSS
E-Mail
50%
50%

Microsoft Nukes Buggy Office 2013 Update

Second batch of faulty software from Microsoft in two months reinforces recommendation to patch in staggered fashion.

10 Hidden Benefits of Windows 8.1
10 Hidden Benefits of Windows 8.1
(click image for larger view)
For the second time in two months, Microsoft has temporarily pulled a software update after users reported that it inadvertently disabled some Windows features.

Microsoft Wednesday removed its Office Update 2013 (KB2817630), which was released Tuesday as part of the company's regularly monthly release of patches. The update contained user interface changes, as well as stability and performance improvements for both the 32-bit and 64-bit versions of Office 2013 and Office Home and Student 2013 RT.

But soon after the update was released, users began reporting difficulties. "I've got Microsoft Office 2013 Professional Plus running on Windows 8 Professional. I just applied today's Microsoft updates, and now that I've done so, the Outlook 'Folder Pane' is empty," one Windows user posted to a Microsoft help forum Tuesday. "I can't view my list of e-mail accounts, folders, favorites, etc."

More reports of frozen Outlook navigation panes soon surfaced, leading Microsoft to pull the patch Wednesday from its Windows Update servers.

[ Microsoft is overhauling its leadership structure. What does it mean? See Microsoft's Journey May Leave Too Many Behind. ]

Later Wednesday, Microsoft confirmed the problem, saying in a blog post that it stemmed from incompatible versions of outlook.exe and mso.dll being on the same system. In particular, "a mismatched reference to a data structure causes the 'minimize' button in the navigation pane to render incorrectly, typically extremely large to the point that the navigation pane is 'invisible' to the user," it said.

Microsoft also noted that, contrary to some press reports, the buggy Office 2013 update had nothing to do with a critical security update for Microsoft Outlook (MS13-068), released Tuesday, that patched a remote code execution vulnerability, but only in the 2007 and 2010 versions of Microsoft Office. Accordingly, "we continue to recommend [this] as a high priority security update," said Wolfgang Kandek, CTO of Qualys, in a blog post.

The bad Office 2013 update followed Microsoft last month pulling an August security update for Exchange Server 2013 (MS13-061) that scrambled search infrastructure settings, thus "placing the content index for all databases into a failed state," according to a Microsoft advisory. About two weeks after removing the patch, Microsoft released a related fix for both Exchange 2013 RTM CU1 and Exchange 2013 RTM CU2.

While Microsoft said it thoroughly tested both of the buggy patches, the double dose of bad code -- one a user interface bug, the other a bad security update -- "underscores the complexity of our current IT environment," said Kandek.

The solution, he said, is to nominate some guinea pigs. "IT administrators at many organizations that we interact with counter this with a 1%, 10%, 100% mechanism, meaning they apply these patches to 1% of the user base on the first day, 10% on the second day -- barring problems -- and going for 100% starting on the third day," he said. "The ultimate goal is to have security patches distributed to all machines by the fifth day." Patch managers would typically also pursue different schedules: one in the short term for critical security updates, for example, and one later for "product enhancement patches" such as this month's Office 2013 update, which contained no security fixes.

Going forward, what might be done to prevent such patch incompatibility problems altogether? "Ultimately I believe that reducing the complexity on the desktop and using more online services for our daily needs is the direction that we are headed," Kandek said.

Learn more about enterprise software by attending the Interop conference track on Applications and Collaboration in New York from Sept. 30 to Oct. 4.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.