Re: Blackboard and IE Patch

[Gary Flynn <flynngn () JMU EDU>]

Allen, Jon D. wrote:

> I was just curious how other institutions that use Blackboard are
> handling the recommendation by Blackboard not to apply the latest IE
> patches.  Obviously with the package containing multiple patches
> including critical security fixes it poses quite the dilemma.  On the
> one hand patching could case major issues with a key academic system.
> On the other hand not patching places systems at a risk of compromise.
> Any philosophies or thoughts?

We've applied the IE cumulative update and all the others
except MS06-015 908531 to all computers subscribed to our
WSUS server ( 954 computers ). I haven't heard of any
complaints from them or from any students ( most of whom
I hope have automatic updates enabled ).

We received information about the problems Blackboard would
have and they're posted at:

http://www.jmu.edu/computing/security/#activex

A handful of desktops accessing an RMS housing application
had to install the patch that disables the ActiveX
functionality change. The vendor has committed to bringing
their application inline with MS recommendations by June.

We're deploying 908531 cautiously and in stages. We've had
problems reported with three desktops when it was installed
at the department level or by manual updates. The MS
windows-update newsgroup is full of reports of problems
due to third party interactions with the update.
Primarily HP software, NVIDIA drivers, and Kerio firewall
software. We're contemplating deploying NVIDIA updates
through WSUS but are weighing the risk of adding another
update that isn't as widely tested as the critical
security updates.

Microsoft has information on problems with 908531 at:

Currently known problems:
http://support.microsoft.com/kb/918165

Microsoft Security Response Center Blog entry on issue
http://blogs.technet.com/msrc/archive/2006/04/18/425473.aspx

Security update:
http://www.microsoft.com/technet/security/Bulletin/MS06-015.mspx

--
Gary Flynn
Security Engineer
James Madison University
www.jmu.edu/computing/security

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature