Feeds

Second time's a charm! Microsoft tries again with Active Directory patch

'The fix actually turned into a bigger problem than the one it was attempting to solve'

Next gen security for virtualised datacentres

Microsoft made a second attempt to cleanly patch an "important" security flaw in its Active Directory Federation Services technology on Monday - days after yanking the original update for causing stability problems.

The original MS13-066 upgrade caused the active directory service to stop working entirely in some cases. The second iteration of the security patch is, we are assured, a much more stable fix.

Bear in mind it should applied to server software usually run within enterprise environments to provide corporate users with Single Sign-On access to internet applications and the like.

"As the vulnerability it was attempting to fix had only been privately reported, and was not believed to be being exploited in the wild, it’s possible that the fix had actually turned into a bigger problem than the one it was attempting to solve – on Windows Server 2008 systems at least," notes security watcher Graham Cluley.

The withdrawal of security updates by Redmond is rare but not unprecedented: August's Patch Tuesday suffered a similar cock-up, forcing Redmond to withdraw a dodgy update for Exchange Server 2013 after it emerged the critical security patch broke the mail indexing service. MS13-061 worked fine on Exchange 2007 and 2010 but not on the latest version of Microsoft's email server software.

The update grapples three vulnerabilities in Microsoft Exchange that stem from bugs in the third-party library Outside In; this is licensed from Oracle and allows Web Access users to view PDF files and such stuff. Exchange Server 2013 users are advised to turn off the functionality as a workaround pending the availability of a working security update. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Best practices for enterprise data
Discussing how technology providers have innovated in order to solve new challenges, creating a new framework for enterprise data.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?