RE: Anyone have hard evidence of problems with Windows Automatic Upda tes?

From: Thomas Cameron <ThomasC(at)mip.com>
Date: Fri Mar 21 2003 - 13:24:56 EST

I *like* to do changes by hand as well.

The hard truth is, the IT staff here does not keep up with updates very well
(I am only here on short term contract while one of the staff is out on
maternity leave).

As far as I can tell, there was one hotfix in 2002 (MS02-061) and one in 2003 (MS03-007) which was re-issued. Both of them only caused problems with pretty limited, specific configurations. Neither would have affected this environment.

I am leaning heavily towards the attitude that the chances of damage through exploits is MUCH higher than the chance of damage through a bad hotfix. There were over 70 problems last year which could have exposed us to damage. There was only one hotfix which *might* have. The servers here are all pretty vanilla, and use strictly Microsoft software, so it's not like we have a convoluted configuration which is likely to be broken.

That's why I asked for hard evidence - I have gotten a ton of responses with anecdotal reports of problems, but only one response with a real problem. That was a configuration which we don't use, so it would not have affected us.

I am eager to participate in further discussion on the topic, though. Comments are encouraged.

Regards,
Thomas Cameron, RHCE, CNE, MCSE, MCT
Best Software - Non Profit and Government Division
(512) 454-1844 x 307

-----Original Message-----
From: Ken Remley [mailto:ken.remley@jfshea.com] Sent: Friday, March 21, 2003 11:23 AM
To: 'Thomas Cameron'; focus-ms@securityfocus.com Subject: RE: Anyone have hard evidence of problems with Windows Automatic Upda tes?

I tend to agree with you co-worker. I like to do those changes by hand as well! Especially if it is doing updates like Service packs to OS or Apps. Alot of time it takes an enormous amout CPU util. as well.

Ken

For the protection of our internal systems and those of our customers, Best Software, Inc., blocks most email attachments. Please use plain text when corresponding via email with Best Software.

---

ALERT: How a Hacker Uses SQL Injection to Steal Your SQL Data! It's as simple as placing additional SQL commands into a Web Form input box giving hackers complete access to all your backend systems! http://www.spidynamics.com/mktg/sqlinjection33 Received on Fri Mar 21 16:06:20 2003