Microsoft Patch Alert: January patches include a reprisal of KB 4023057 and a swarm of lesser bugs

Credit to Author: Woody Leonhard| Date: Wed, 30 Jan 2019 09:12:00 -0800

In general, the January patches look relatively benign, but for some folks in some situations they can bite. Hard.

On the surface we’ve seen the usual Patch Tuesday Cumulative Updates and secondary Cumulative Updates for all versions of Windows 10. Microsoft calls the secondary Cumulative Updates “optional” because you only get them if you click “Check for updates.”

Windows 7 and 8.1 got their usual Monthly Rollups, but there’s a problem. Specifically, this month’s Win7 Monthly Rollup has a couple of bugs that are only fixed if you install the preview of February’s Monthly Rollup. Which makes no sense at all, but that’s Microsoft. There’s another Win7 Monthly Rollup bug that’s fixed by installing a different “silver bullet” patch.

A Win10 version 1809 .NET patch, KB 4481031, rolled out as a Preview when it wasn’t. Some folks woke up one morning to a notification that their PC was no longer activated. That was a bug on Microsoft’s side. Oops.

Office 2010 took one on the chin. Two, actually. And it looks like the Japanese calendar problem’s still there, with “fixes” bringing Word, Excel and Access to a halt.

And then there’s a reprisal of the mysterious KB 4023057 “update reliability” patch, throwing error 0x80070643 on some machines.

It’s been a patch pokin’ month.

All of the extant versions of Windows 10 got Patch Tuesday cumulative updates this month, and then the usual second round of cumulative updates. The former came down the Automatic Update chute; the latter lie in wait unless you click “Check for updates.” That’s been the common, infuriating, behavior for several months. Nothing new.

What isnew is the remarkable delay in releasing the second patch for Win10 version 1809 – the KB 4476976 “October 2019 Update.” Microsoft held onto that patch for an extra week, putting it through an unusual second round of beta tests in the Windows Insider Preview Ring. That’s great news: It shows Microsoft’s taking its time to push out the 1809 updates.

 It remains to be seen if the new-found restraint will result in less-buggy patches, but slowing down the gauntlet certainly rates as a step in the right direction.

The two major bugs in all of this month’s Win10 patches are the acknowledged ones:

The first bug strikes (old!) applications written in Access 97 and in other database packages. There’s a manual solution, but it isn’t pretty, and it requires you to convert the database to a newer format. That’s not welcome news to anyone who’s nursing an old database.

The second bug has a simple workaround: Don’t use Edge. As if you needed me to tell you that.

This was yet another Keystone Kops patch. Microsoft originally released KB 4481031 with a KB article that said it was a “Preview of Cumulative Update.” It was actually a real patch. Microsoft pushed KB 4481031 out the Windows Update chute. That, we were told two days later, was a mistake. Right now, I’m told, KB 4481031 is a for-real cumulative update that’s only being pushed to people who click “Check for updates.”

I don’t believe the conspiracy theories – that Microsoft’s intentionally planting bugs in Win7 patches to prod people on to Win10. But I do believe the complacency theories – that Microsoft’s focusing on Win10 efforts to the detriment of Win7 users, in particular.

This month we saw two big bugs introduced in the Win7 Monthly Rollup, along with the Access 97 file format problem in Win10:

The first problem is pretty specific: You have to be running a peer-to-peer network, and the person trying to get to the shared folders has to have an administrator account on the shared folder’s PC. Microsoft released a “Silver Bullet” patch for this specific problem, KB 4487345. Susan Bradley has a more detailed explanation – and advice if KB 4487345 doesn’t work – in her Patch Watch column.

The second problem (which isn’t acknowledged in the Monthly Rollup KB article) can be fixed by installing the preview of next month’sWin7 Monthly Rollup, KB 4480955.

There’s an additional problem. Installing KB 4480970 (this month’s Monthly Rollup) or KB 4480960 (security-only) breaks RDP on Server 2008 R2 systems. It looks like installing the Silver Bullet patch KB 4487345 also fixes this problem.

Patch Tuesday also brought an embarrassing barrage of activation failures and “Not genuine” / ”counterfeit copy of Windows” notifications on Win7 machines with volume licenses. Microsoft has confirmed that the problem isn’t with this month’s update, it’s with Microsoft’s activation servers. Which have since been fixed. Supposedly.

Windows 8.1 continues its admirable stretch as the most stable version of Windows yet.

Now in its 50th-or-so incarnation, KB 4023057, the “update reliability improvement” rolled out to Win10 1507, 1511, 1607, 1703, 1709 and 1803 machines. Microsoft still hasn’t said what KB 4023057 actually does, the KB article is a baffling bit of bull… pablum.

Speculation is that KB 4023057 blasts away any impediments you’ve set to the automatic installer. @ch100 on AskWoody has offered the only explanation that makes sense to me:

KB4023057 was and still is one of the most weird and unexplained updates in the recent times. This update has never been offered to WSUS, but only to Windows Update. This would indicate that it [was] meant for unmanaged end-users and unmanaged small business users…

This patch may be harmless, but why it was released and where it actually applies, it is still a mystery.

Patch Tuesday also brought KB 4461614, an Office 2010 security update. Unfortunately, as soon as you install that patch, Access and Excel stop working. Ten days later, Microsoft issued a replacement, KB 4462157. Now we have notices that KB 4462157 breaks Office 2010 entirely on Windows XP machines.

Pro tip: If you’re still running XP, you have worse things to worry about.

We’ll keep you posted on patches on the AskWoody Lounge.

http://www.computerworld.com/category/security/index.rss