My MS04-028 FAQ

The instructional text in this latest MS04-028 Security Bulletin seems
totally ridiculous for anyone trying to effect patch management on more
than 3 PC's. Their FAQ is just blowing me away. I'm not sure
whether to laugh or to cry. Here's my FAQ. Let's see them answer
THESE!

Feel free to play along and either answer or add to the list. It
won't likely accomplish much, but it will be more fun (and probably
more productive) than sitting in a meeting with a bunch of other
confused IT's trying to figure out "how to deploy this one."

1. Are you *%^ing kidding me! OK, I just had to get that out. Moving
on...
2. What is this "vulnerable component"?
"Windows XP, Window XP Service Pack 1, and Windows Server 2003 are
the only operating systems that contain the *vulnerable component* by
default. By default, Windows 98, Windows 98 SE, Windows Me, Windows NT
4.0, and Windows 2000 are not. However, the *vulnerable component* will
be installed by any of the programs listed in the affected software
section of this bulletin on these operating systems and you should
install the appropriate security update for those programs."
3. Is it "GDI+"? (Then say so!)
4. If it is GDI+ and Windows is such a shared resource OS, why can't
the GDI+ component be patched at the OS level without requiring a patch
for each individual app?
5. "Typically, when these programs are installed on Windows XP,
Windows XP Service Pack 1, or Windows Server 2003 they only use the
version that is provided by the operating system, even if they install
a copy of the vulnerable component." Oh, really? (Trying to find a
nice way of asking #1 again.)
6. Can the "vulnerable component" be removed/uninstalled?
7. Would removing it disable viewing/using JPEG files and/or disable
some other desired functionality?
8. Would removing the .Net Framework help the situation?
9. Does this prove my original fears that installing the .Net Framework
is merely an act of inviting *yet another MS security nightmare*?
10. If the recent .Net Framework 1.0 & 1.1 SP's contained such
critical patches as this one, why didn't MS issue a Security Bulletin
for them?
11. Why DOESN'T the "GDI+ Detection Tool" do all the things that
MS tells us it doesn't do? (Basically: why doesn't it detect ALL
affected sw AND tell us whether that sw is patched?)
12. If the existing GDI+ detector says I'm clean, and then I install
something vulnerable, am I "SOL"? Will the detector say, "I've
already run," and ignore my new app?
13. Can MS provide us with a detector that works?
14. Will someone else make one that works?
15. If so, can we buy *their* OS and/or sw?
16. Does this vulnerability affect only MS sw?
17. Are any other sw companies saying, going to say, or have they
already said anything about this vulnerability in regards to their sw?
18. If so, is it only because they're using MS SDK's to write their
sw?
19. Is it time to jump the MS ship?
20. How many more MS apps are going to get their own patches for this
same vulnerability a month or two down the road?
21. How many vulnerable apps won't get patches because MS doesn't
"support" them anymore? (implies they "supported" these apps
previously)
22. Should I simply use the GDI Detection Tool to find the vulnerable
apps and just remove those apps rather than wait for a follow-up patch
that "fixes" the same vulnerability and/or a totally new and
scarier one?
23. Which Linux distro should I start with if I'm a newbie to it, but
have been in IT for 15+ years?
24. How do I know what hardware to put this Linux distro with if I'm
building a new system?
25. How do I build a completely MS-free, Linux-based system that even
my technophobe wife (who may freak if it doesn't look exactly like
our old MS system) can use?
26. Is Linux any better, since I'll have to depend on several distros
and/or word of mouth to get bug/security fixes for it, as opposed to
one company like MS?
27. Last but far from least, the associated WindowsUpdate entry for
MS04-028 doesn't update anything. So, why is it listed as a Critical
Update?

Walla
Wed Sep 15 11:47:14 CDT 2004

I feel your pain. I think this hole is a testament to code reuse at
Microsoft. Which is a good thing from a productivity standpoint of a
software manufacturer. Either this same peice of code, or code compiled
with the same compiler has an overrun or whatnot. I read it too and thought
it was really an ugly bulletin. Basically it says here, if you run these
you need to patch. The more of them you run, the more of them you patch.
Another reason why a software monoculture can be a bad thing.


"Robb" <hay_robb@yahoo.com> wrote in message
news:ci9q39$ss1@odak26.prod.google.com...
> The instructional text in this latest MS04-028 Security Bulletin seems
> totally ridiculous for anyone trying to effect patch management on more
> than 3 PC's. Their FAQ is just blowing me away. I'm not sure
> whether to laugh or to cry. Here's my FAQ. Let's see them answer
> THESE!
>
> Feel free to play along and either answer or add to the list. It
> won't likely accomplish much, but it will be more fun (and probably
> more productive) than sitting in a meeting with a bunch of other
> confused IT's trying to figure out "how to deploy this one."
>
> 1. Are you *%^ing kidding me! OK, I just had to get that out. Moving
> on...
> 2. What is this "vulnerable component"?
> "Windows XP, Window XP Service Pack 1, and Windows Server 2003 are
> the only operating systems that contain the *vulnerable component* by
> default. By default, Windows 98, Windows 98 SE, Windows Me, Windows NT
> 4.0, and Windows 2000 are not. However, the *vulnerable component* will
> be installed by any of the programs listed in the affected software
> section of this bulletin on these operating systems and you should
> install the appropriate security update for those programs."
> 3. Is it "GDI+"? (Then say so!)
> 4. If it is GDI+ and Windows is such a shared resource OS, why can't
> the GDI+ component be patched at the OS level without requiring a patch
> for each individual app?
> 5. "Typically, when these programs are installed on Windows XP,
> Windows XP Service Pack 1, or Windows Server 2003 they only use the
> version that is provided by the operating system, even if they install
> a copy of the vulnerable component." Oh, really? (Trying to find a
> nice way of asking #1 again.)
> 6. Can the "vulnerable component" be removed/uninstalled?
> 7. Would removing it disable viewing/using JPEG files and/or disable
> some other desired functionality?
> 8. Would removing the .Net Framework help the situation?
> 9. Does this prove my original fears that installing the .Net Framework
> is merely an act of inviting *yet another MS security nightmare*?
> 10. If the recent .Net Framework 1.0 & 1.1 SP's contained such
> critical patches as this one, why didn't MS issue a Security Bulletin
> for them?
> 11. Why DOESN'T the "GDI+ Detection Tool" do all the things that
> MS tells us it doesn't do? (Basically: why doesn't it detect ALL
> affected sw AND tell us whether that sw is patched?)
> 12. If the existing GDI+ detector says I'm clean, and then I install
> something vulnerable, am I "SOL"? Will the detector say, "I've
> already run," and ignore my new app?
> 13. Can MS provide us with a detector that works?
> 14. Will someone else make one that works?
> 15. If so, can we buy *their* OS and/or sw?
> 16. Does this vulnerability affect only MS sw?
> 17. Are any other sw companies saying, going to say, or have they
> already said anything about this vulnerability in regards to their sw?
> 18. If so, is it only because they're using MS SDK's to write their
> sw?
> 19. Is it time to jump the MS ship?
> 20. How many more MS apps are going to get their own patches for this
> same vulnerability a month or two down the road?
> 21. How many vulnerable apps won't get patches because MS doesn't
> "support" them anymore? (implies they "supported" these apps
> previously)
> 22. Should I simply use the GDI Detection Tool to find the vulnerable
> apps and just remove those apps rather than wait for a follow-up patch
> that "fixes" the same vulnerability and/or a totally new and
> scarier one?
> 23. Which Linux distro should I start with if I'm a newbie to it, but
> have been in IT for 15+ years?
> 24. How do I know what hardware to put this Linux distro with if I'm
> building a new system?
> 25. How do I build a completely MS-free, Linux-based system that even
> my technophobe wife (who may freak if it doesn't look exactly like
> our old MS system) can use?
> 26. Is Linux any better, since I'll have to depend on several distros
> and/or word of mouth to get bug/security fixes for it, as opposed to
> one company like MS?
> 27. Last but far from least, the associated WindowsUpdate entry for
> MS04-028 doesn't update anything. So, why is it listed as a Critical
> Update?
>

Walla
Wed Sep 15 11:59:34 CDT 2004


"Robb" <hay_robb@yahoo.com> wrote in message
news:ci9q39$ss1@odak26.prod.google.com...
> The instructional text in this latest MS04-028 Security Bulletin seems
> totally ridiculous for anyone trying to effect patch management on more
> than 3 PC's. Their FAQ is just blowing me away. I'm not sure
> whether to laugh or to cry. Here's my FAQ. Let's see them answer
> THESE!
>
> Feel free to play along and either answer or add to the list. It
> won't likely accomplish much, but it will be more fun (and probably
> more productive) than sitting in a meeting with a bunch of other
> confused IT's trying to figure out "how to deploy this one."
>
> 1. Are you *%^ing kidding me! OK, I just had to get that out. Moving
> on...
> 2. What is this "vulnerable component"?
> "Windows XP, Window XP Service Pack 1, and Windows Server 2003 are
> the only operating systems that contain the *vulnerable component* by
> default. By default, Windows 98, Windows 98 SE, Windows Me, Windows NT
> 4.0, and Windows 2000 are not. However, the *vulnerable component* will
> be installed by any of the programs listed in the affected software
> section of this bulletin on these operating systems and you should
> install the appropriate security update for those programs."
> 3. Is it "GDI+"? (Then say so!)
> 4. If it is GDI+ and Windows is such a shared resource OS, why can't
> the GDI+ component be patched at the OS level without requiring a patch
> for each individual app?
> 5. "Typically, when these programs are installed on Windows XP,
> Windows XP Service Pack 1, or Windows Server 2003 they only use the
> version that is provided by the operating system, even if they install
> a copy of the vulnerable component." Oh, really? (Trying to find a
> nice way of asking #1 again.)
> 6. Can the "vulnerable component" be removed/uninstalled?
> 7. Would removing it disable viewing/using JPEG files and/or disable
> some other desired functionality?
> 8. Would removing the .Net Framework help the situation?
> 9. Does this prove my original fears that installing the .Net Framework
> is merely an act of inviting *yet another MS security nightmare*?
Yes

> 10. If the recent .Net Framework 1.0 & 1.1 SP's contained such
> critical patches as this one, why didn't MS issue a Security Bulletin
> for them?
> 11. Why DOESN'T the "GDI+ Detection Tool" do all the things that
> MS tells us it doesn't do? (Basically: why doesn't it detect ALL
> affected sw AND tell us whether that sw is patched?)
> 12. If the existing GDI+ detector says I'm clean, and then I install
> something vulnerable, am I "SOL"? Will the detector say, "I've
> already run," and ignore my new app?
> 13. Can MS provide us with a detector that works?
> 14. Will someone else make one that works?
> 15. If so, can we buy *their* OS and/or sw?
> 16. Does this vulnerability affect only MS sw?
> 17. Are any other sw companies saying, going to say, or have they
> already said anything about this vulnerability in regards to their sw?
> 18. If so, is it only because they're using MS SDK's to write their
> sw?
> 19. Is it time to jump the MS ship?
I'd get familiar with some of the other things out there.

> 20. How many more MS apps are going to get their own patches for this
> same vulnerability a month or two down the road?
A bunch.

> 21. How many vulnerable apps won't get patches because MS doesn't
> "support" them anymore? (implies they "supported" these apps
> previously)
> 22. Should I simply use the GDI Detection Tool to find the vulnerable
> apps and just remove those apps rather than wait for a follow-up patch
> that "fixes" the same vulnerability and/or a totally new and
> scarier one?
> 23. Which Linux distro should I start with if I'm a newbie to it, but
> have been in IT for 15+ years? Red Hat or Mandrake

> 24. How do I know what hardware to put this Linux distro with if I'm
> building a new system? Get a Knoppix bottable iso. If it runs, your
machine will run Linux.

> 25. How do I build a completely MS-free, Linux-based system that even
> my technophobe wife (who may freak if it doesn't look exactly like
> our old MS system) can use?
Currently difficult.



> 26. Is Linux any better, since I'll have to depend on several distros
> and/or word of mouth to get bug/security fixes for it, as opposed to
> one company like MS?
Red Hat and Suse to name two have an update feature built in ala Winodws
update

> 27. Last but far from least, the associated WindowsUpdate entry for
> MS04-028 doesn't update anything. So, why is it listed as a Critical
> Update?
>

an_anonymous_opinion
Wed Sep 15 13:17:30 CDT 2004

>-----Original Message by Robb-----<
>The instructional text in this latest MS04-028 Security=20
>Bulletin seems totally ridiculous for anyone trying to=20
>effect patch management on more than 3 PC's.
<[message truncated]

I agree 100%: Microsoft really dropped the ball on this=20
one. It's a completely sloppy and confusing bulletin.

To make matters worse, it would seem Microsoft left all=20
the work to the user(s) instead of Microsoft doing the=20
scanning and patching. Why are user(s) stuck doing the=20
manual labor of patching this and that for products THEY=20
paid for?

Enjoy those pi=F1a coladas, Mr. Gates.

Karl
Wed Sep 15 22:02:49 CDT 2004

It's a confusing bulletin, but mainly because the underlying technologies
and steps required to patch are confusing. The bulletin itself is I think
as usual pretty well written, except that it's so long it's hard to fully
grasp all the issues even after several readings.

Microsoft released a tool to help users find vulnerable files to try to ease
your pain at trying to scan products that Windows Update won't scan. There
are plenty of third party programs [Macromedia software like Flash, WS_FTP,
etc.] that include the vulnerable gdiplus.dll file. If you're blaming
Microsoft and asking them to be able to scan for all those third party
products, that's just never going to happen, in any OS.

MS has heard the complaint that patching is too painful and has made and
continues to make improvements. Granted, it's still painful and it's too
bad those improvements aren't all ready today.


"an_anonymous_opinion" <anonymous@discussions.microsoft.com> wrote in
message news:027d01c49b50$43a285b0$a301280a@phx.gbl...
>-----Original Message by Robb-----<
>The instructional text in this latest MS04-028 Security
>Bulletin seems totally ridiculous for anyone trying to
>effect patch management on more than 3 PC's.
<[message truncated]

I agree 100%: Microsoft really dropped the ball on this
one. It's a completely sloppy and confusing bulletin.

To make matters worse, it would seem Microsoft left all
the work to the user(s) instead of Microsoft doing the
scanning and patching. Why are user(s) stuck doing the
manual labor of patching this and that for products THEY
paid for?

Enjoy those piña coladas, Mr. Gates.

Karl
Wed Sep 15 22:17:14 CDT 2004


"Robb" <hay_robb@yahoo.com> wrote in message
news:ci9q39$ss1@odak26.prod.google.com...

> 4. If it is GDI+ and Windows is such a shared resource OS, why can't
> the GDI+ component be patched at the OS level without requiring a patch
> for each individual app?

The problem as I see it is that Windows 2000 and older don't come with GDI+.
So MS and non-MS apps often contain the gdiplus.dll file in case it is
needed. It's possible that this could have been handled better, but there
are smart people providing convincing arguments on both sides on this issue.

> 8. Would removing the .Net Framework help the situation?

Probably not. GDI+ seems to be coming whether we like it or not.

> 9. Does this prove my original fears that installing the .Net Framework
> is merely an act of inviting *yet another MS security nightmare*?

Again, with the new things being created via the .NET Framework, it seems
like it's coming whether we like it or not.

> 10. If the recent .Net Framework 1.0 & 1.1 SP's contained such
> critical patches as this one, why didn't MS issue a Security Bulletin
> for them?

Because then people would have complained about the vuln being unpatched in
other software. Patch testing for all the various language variations and
service pack levels actually takes quite a long time.

> 13. Can MS provide us with a detector that works?

It would appear you can just search the hard drive(s) for the gdiplus.dll
file.

> 14. Will someone else make one that works?
> 15. If so, can we buy *their* OS and/or sw?

Buy Linux. It's totally secure.

> 16. Does this vulnerability affect only MS sw?
> 17. Are any other sw companies saying, going to say, or have they
> already said anything about this vulnerability in regards to their sw?

It would appear that one Mozilla development package released a new build of
their software with the new MS .DLL file. I didn't really see any mention
of it.

> 19. Is it time to jump the MS ship?

No one is stopping you, except maybe you. Go for it. There must be a
reason you haven't yet.

> 21. How many vulnerable apps won't get patches because MS doesn't
> "support" them anymore? (implies they "supported" these apps
> previously)

You can always get a MS patch, although if you're going to bog MS down with
old old software, you may have to pay for its development. That's only
fair, because your insistence on using Windows 3.11 makes it that much
harder for MS to do patching for the rest of us.

> 23. Which Linux distro should I start with if I'm a newbie to it, but
> have been in IT for 15+ years?

You could try Knoppix or Knoppix-STD, or any other "live boot" CD. Run
Linux free on about any computer, windows or otherwise, entirely from a boot
CD, nothing to install.

> 24. How do I know what hardware to put this Linux distro with if I'm
> building a new system?

That's up to you really.

> 25. How do I build a completely MS-free, Linux-based system that even
> my technophobe wife (who may freak if it doesn't look exactly like
> our old MS system) can use?

You could try Lindows, now known as Linspire.

Torgeir
Thu Sep 16 14:04:23 CDT 2004

Karl Levinson [x y] mvp wrote:

> It's a confusing bulletin, but mainly because the underlying technologies
> and steps required to patch are confusing. The bulletin itself is I think
> as usual pretty well written, except that it's so long it's hard to fully
> grasp all the issues even after several readings.
>
> Microsoft released a tool to help users find vulnerable files to try to ease
> your pain at trying to scan products that Windows Update won't scan.

Note that this tool will only scan for Microsoft products listed in
http://www.microsoft.com/technet/security/bulletin/ms04-028.mspx


> There
> are plenty of third party programs [Macromedia software like Flash, WS_FTP,
> etc.] that include the vulnerable gdiplus.dll file. If you're blaming
> Microsoft and asking them to be able to scan for all those third party
> products, that's just never going to happen, in any OS.
>
> MS has heard the complaint that patching is too painful and has made and
> continues to make improvements. Granted, it's still painful and it's too
> bad those improvements aren't all ready today.



--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx