Microsoft stuffs up six patches
Patching the patches
Red-faced Microsoft has admitted that there were problems with KB 2876063, KB 2859537, KB 2873872, KB 2843638, KB 2843639, and KB 2868846, all released on Tuesday.
The MS13-061/KB 2876063 patch was supposed to fix a remote code execution hole in Exchange Server. The problem only affects Exchange 2013 and the Vole said that after the installation of the security update, the content index for mailbox databases shows as failed and the Microsoft Exchange search host controller service is renamed.
Those who have already installed the MS13-061 security update for Exchange Server 2013 are advised to download KB 2879739, which provides the steps on how to resolve the problem. The MS13-061 security update has been pulled temporarily. Exchange 2010 or Exchange 2007 can breathe a sigh of relief as this does not affect them.
In this case the problem might not have been Microsoft. According to the SANS Internet Storm Centre, Oracle disclosed the vulnerabilities in patch updates in April and July 2013 and Microsoft licensed the vulnerable libraries from Oracle.
Another patch which was botched was the catchy-titled MS13-063/KB 2859537. It is a Windows kernel patch that has not been entirely pulled.
Apparently some users may experience problems with certain games after they install security update 2859537. In some cases, users may not successfully start and sign in to the games. The Vole is still looking at how to fix that problem. Rift crashes immediately after authentication, as does Defiance.
Softpedia reports that the patch causes the dreaded blue screen of death on Windows 7 systems.
The MS13-066/KB 2873872/KB 2843638/KB 2843639/KB 2868846 patches for active directory federation services have all been pulled because they break the ADFS.
Microsoft has removed the updates for ADFS 2.0 from Windows update and the download centre and is looking into the problem.
Apparently users can also have problems with security update 2843639 if they do not have update 2790338 already applied. Microsoft said that users should try and install this one right away.
Last month, the Vole botched four of its patches so it has not been a good summer for Microsoft. At least there's a public confession.
