Re: questions re Microsoft updates?

[Scott Fendley <scottf () UARK EDU>]

Well from my point of view (University of Arkansas and connections within
the Internet Storm Center @SANS),  this months round of patches appears to
have been a rush job.

There were 4 announced security bulletins, a re-release of a number of
others involving Exchange Server  And a bonus patch that relates to
MS04-004 issues.  The CHM Internet Explorer vulnerability may have been
fixed, but you wouldn't know that for sure unless you looked at the  CVE or
CAN notes  tied to each of the MS Vulnerabilities.

Other then the slowness of patches coming down, and that the Outlook patch
tends to fail the first try (while patching the other 4), it was not as bad
as it could have been.  However I have heard a single note that said
something to the effect that the rpc patch might be breaking more things
then it fixes....I do not have any supporting evidence to that
though.  Overall I am sitting on hitting production servers and hope we do
not have a 0day worm come out later this week.  Workstations i think should
be okay to patch.

Scott Fendley

At 05:18 PM 4/13/2004 -0400, you wrote:
> It appears that Microsoft has not released the updates yet.  At least, I
> cannot get our SUS (Software Update Services) server to download the
> patches yet. :-/
>
> Does anyone have any concerns about deploying the patches?
>
> Jon
> ----- Original Message -----
> From: <mailto:dodpears () INDIANA EDU>Doug Pearson
> To: <mailto:SECURITY () LISTSERV EDUCAUSE EDU>SECURITY () LISTSERV EDUCAUSE EDU
> Sent: Tuesday, April 13, 2004 4:52 PM
> Subject: [SECURITY] questions re Microsoft updates?
>
> Dear all,
>
> The REN-ISAC participates in a daily cybersecurity status conference call
> with other ISACs, US-CERT, and DHS. This Friday, the group will be joined
> by representatives from Microsoft to discuss the April Windows security
> updates. I can take questions you have regarding the updates to the call,
> and will report back.
>
> If you haven't checked the updates - published today - you probably
> should. Several are critical.
> <http://www.microsoft.com/security/security_bulletins/200404_windows.asp>http://www.microsoft.com/security/security_bulletins/200404_windows.asp
>
> Regards,
>
> Doug Pearson
> Research and Education Networking ISAC
> <http://www.ren-isac.net>http://www.ren-isac.net
> Watch Desk 24x7: +1(317)278-6630
>
> **********
> Participation and subscription information for this EDUCAUSE Discussion
> Group discussion list can be found at
> <http://www.educause.edu/cg/>http://www.educause.edu/cg/.
>
> ********** Participation and subscription information for this EDUCAUSE
> Discussion Group discussion list can be found at http://www.educause.edu/cg/.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.