News

Flawed April Security Bulletin Slated for Re-Release Tuesday

• By Scott Bekker
• April 21, 2006

"We're going to run a test pass on it and we will release this new update on Tuesday, April 25," Stephen Toulouse, a program manager for the Microsoft Security Response Center, disclosed in a posting Friday on the MSRC blog, where Microsoft has been updating users on the issue since Saturday.

The troubled patch is MS06-015. Originally released April 11 in Microsoft’s monthly "Patch Tuesday" event with four other bulletins, MS06-015 addressed a critical vulnerability in Windows Explorer that could allow remote code execution.

According to Microsoft, "well under a thousand" users reported problems with older versions of HP's "Share-to-web" software and older NVIDIA video card drivers. Both companies have newer versions of the software available for download online.

Microsoft initially provided user workarounds including a registry key fix, uploading the latest version of the HP or NVIDIA software or uninstalling the software. Some of those options are detailed in a Knowledge Base Article here.

Toulouse wrote that the new patch will have detection logic so it will only install on affected systems or on systems that haven't received the patch at all.

In trying to put the number of complaints in perspective, Microsoft released an interesting bit of data about the ubiquity and speed of its patching infrastructure: As of April 18, one week after the patch was first released, it had been successfully installed 120 million times.