Microsoft .NET Patch May Make PCs Go "Haywire"

yuna49 writes "Various people are reporting that the MS07-040 patch for .NET released on Tuesday can cause a variety of seemingly unrelated problems. According to the SANS Internet Storm Center 'the reports we got so far seem not to lead to any specific thing that happens in many cases, just various things going haywire.' Some commentators on The Register's report of this story indicate that the patch failed to install at all, while others report things like the mouse suddenly failing to work or long periods of hard drive thrashing. In some cases a hard reboot seems to fix the problem, but other reports suggest that a reinstallation of the .NET framework itself is required. The problems may be related to the MSCORSVW.EXE process which recompiles all the .NET assemblies when the patch is downloaded. While the recompilations are supposed to run as a background task, in some instances the recompilation will drive the processor to 100% usage."

Re:Sonofa...

[Macthorpe]

Well, I can't admit to seeing any issues here, not that it denies the existence of them elsewhere.

I'm quite surprised that this doesn't happen more often, actually. The last time I remember a problem with a Windows Update that made the news was sometime towards the end of last year. Someone can correct me, though, if they feel the need.

Sit on it...

[Heem]

And this is why I sit on patches for at least a couple of weeks.

"Declined"

100% CPU ?

[herve_masson]

in some instances the recompilation will drive the processor to 100% usage

No, kidding ? You mean the background task don't deliberately leave CPU cycles for the sake of increasing idle time ? Amazing.
This kind of summary don't push me hard to RTFA.

Familiar symptoms?

[griffjon]

others report things like the mouse suddenly failing to work or long periods of hard drive thrashing. In some cases a hard reboot seems to fix the problem, but other reports suggest that a reinstallation of the .NET framework itself is required

Wait; so, random failures, hard drive thrashing, rebooting and/or reinstalling works? Isn't that the normal user experience in Windows anyhow?

DUPE! ;)

Re:Win2003

[LurkerXXX]

Wed morning? The day before was patch tuesday. Why is your company installing patches on production servers they day they come out?

You should have a test machine set up and run ALL new patches on it for at least a few days to make sure they don't hork anything up before rolling them out to production machines.

Re:Sit on it...

[Bacon Bits]

It's a remote code execution fix. It is irresponsible to dismiss it out of hand. If you're not applying the patch, you have up to three workarounds per system to apply. The workaround, by the way, is basically to disable Active Scripting. That is, no Java Script and no ActiveX controls. That's typically not satisfactory. The IIS ASP.NET fix is to strip NULLs from input. That's not going to happen very easily for proprietary web app software.

Are you also "sitting on" MS07-039? Denial of service on AD is bad. Every admin I know applied this patch on Tuesday.

You also, you know, could be testing the patch in your environment before deployment to see if any issues arise.

The issue is also fairly uncommon from what I've seen. The majority of admins I've heard from have experienced no issues. If it's actually an issue with the patch and not just a AV scanner file locking issue due to the patch being 15 MB (which it has been for at least two people I've heard from) then MS will issue a revision.

A far, far worse bug is the fact that can break recent versions of Sharepoint.

Re:Sit on it...

[Heem]

A week or so isn't going to be the end of the world. I'll wait for you guys to break your environments. I mean, if they are patching something - it HAS been broken all this time - since I installed the box. it didn't just break yesterday and then the patch came right out.

And plus, all my boxes are only on the internal network. Sure, they say your worst enemy is your own employees - I say my worst enemy is broken Microsoft Patches.

So go ahead, upgrade your boxes on patch tuesday. I've just had way to many experiences where that has caused me serious grief.

 

Question: Are the problems deliberate in some way?

[Futurepower(R)]

Possibly this is all part of a drive to get people with no technical experience to buy new computers. If you apply patches, Microsoft has control over how fast your computer runs.

For example, Problems with an important Windows component, svchost.exe, can consume up to 100% of CPU time. [windowssecrets.com]

On one computer with which I am familiar, the RPC service takes 30%-70% of the CPU time.

I'm not saying Microsoft managers deliberately slow computers. I'm saying that maybe they are not particularly intense about fixing bugs that slow computers.

I'm not the only person who thinks that may be an issue. See this quote from the parent comment: "I've been thinking that MS would come up with something that would make XP less useful - some sort of bug or new type of unpatchable vulnerability to force Windows users to adopt Vista. Maybe this is the beginning of the end of XP."

For a lot of us, using Microsoft software has the feeling of partnering with an enemy.

The person who wrote the parent comment could fix the problem himself. Most people, maybe 99% of Windows XP users, could not. Most people who find that there computer is running very slow will buy another computer. The New York Times article Corrupted PC's Find New Home [nytimes.com] makes that point.