19 responses to “MS-DEFCON 4: Patch everything except the Office 2010 Service Pack”

1. 

   Gareth November 5th, 2011 at 01:56

   Hi Woody.

   Doubtless other people will ask, but does this mean you’re giving the green light to this month’s .NET patches?

   Also, interesting to note that Windows Update *is* offering me Office 2007 SP3, but no sign of 2010 SP1 yet.

2. 

   Carlos November 6th, 2011 at 03:58

   Hi Woody. You say,”There’s no particularly good reason to install Office 2007 SP3, either.”

   Can you please expand a little on why it’s not desirable to install this? Is there any disadvantage to doing so?

   I run Win7 and it was included in Windows Update but unchecked. Naturally I didn’t install.

   Regards, Carlos

3. 

   Ann November 6th, 2011 at 05:20

   Woody: Should we also include the update for .NET framework 2.0 SP2 on Windows Server 2003 and Windows XP x86 (KB 2572073)?

4. 

   Tom R. November 6th, 2011 at 07:12

   So I should patch KB2572077, which is a NET patch?

5. 

   rc primak November 6th, 2011 at 16:13

   Woody, does “everything” include .NET Framework?

6. 

   woody November 6th, 2011 at 22:17

   @RC -

   Yes. I’m throwing in the towel again on the .NET patches – get them applied now, just in case next week’s crop brings up some real killers.

7. 

   woody November 6th, 2011 at 22:17

   @Tom -

   Yes. I should’ve been more explicit. Sorry about that.

8. 

   woody November 6th, 2011 at 22:18

   @Ann -

   Yes. Sorry I wasn’t more explicit.

9. 

   woody November 6th, 2011 at 22:19

   @Carlos -

   It’s unchecked because Microsoft itself is worried that there are problems with the SP. In a couple of months, they’ll start checking the box.

   Service Packs are rarely needed immediately, especially if you’ve been keeping up on patches. This one’s a real yawner. May as well wait and see if any problems crop up.

10. 

    woody November 6th, 2011 at 22:20

    @Gareth -

    Yep, that includes the .NET patches. Apologize for not making that explicit… And hold off on both Office SP’s. They’re too green.

11. 

    Athlonite November 8th, 2011 at 03:20

    Hi Woody!
    Have been reading a bit on this new threat and MS’ quick fix :

    http://www.networkworld.com/news/2011/110411-microsoft-duqu-fix-252788.html?source=NWWNLE_nlt_daily_am_2011-11-07

    MS Quick Fix:

    http://support.microsoft.com/kb/2639658

    Should we apply this fix or just wait for the patch to come out?

    How much of a threat does this pose to the ordinary PC user?

    Thanks.

12. 

    woody November 9th, 2011 at 10:28

    @Athlonite -

    I don’t see any threat at all to normal individual users. Corporations in sensitive industries might be concerned, but Duqu isn’t targeted at normal users – and I don’t think any normal users are infected.

13. 

    rc primak November 9th, 2011 at 22:16

    I applied the Office Service Pack (even though I thought I had removed Office from my Toshiba laptop long ago — I am still getting patches for it, which is strange). This was before seeing your advice to skip the Service Pack. I was later offered additional Office patches, which I also applied. No harm done, but I just wanted to post that if the SP is applied, a second trip to MS Updates is necessary to pick up possible additional Office patches. And the November MS Updates also include a few Office patches.

    I read about the exploit which Athlonite is concerned about. Granted that this is not much of a threat to home users, but the intended main effect of the Fix-It is to disable True Type. Most home users would never miss this feature, if I understand which feature this really is. Some applications may need the feature for their fonts to work properly, but most of the time this seems to be an unimportant feature.

    Just want folks to know what the Fix-It does. The Duqu exploit is said to be a Stuxnet-type Trojan Horse, which installs a keylogger, steals data, and then uninstalls itself in 30 days. Again, no reports of home users getting infected, and I suspect the major antivirus companies will offer counter-measures soon. Strictly an optional Fix-It as it appears now.

14. 

    Athlonite November 10th, 2011 at 00:38

    Thanks Woody & RC for this info. As it stands, I will hold off on installing the “Fix It” for now and wait for the official patch (if there is one).

15. 

    Carr November 12th, 2011 at 02:12

    Hey Woody .. I just found you (through your Windows XP all-in-one desk reference For Dummies). I’m trying to learn how to care for my computer and programs to get optimal performance. I’m afraid I’m lost on the patches and updates etc. I’ve always done the automatic update, but took your advice and changed the setting to alert me, but don’t update automatically. Now I’ve gotten an alert to the following update:

    KB2641690 … Fraudulent digital certificates could allow spoofing … whatever the heck that is.

    Do I download this or not? Also, where do I go from here. I’m guessing everything beyond two days ago has been automatically updated since that was my setting. Can you give me tips on how know when and when to not update. Thanks.

16. 

    pcguy November 12th, 2011 at 03:40

    Disable TrueType?? Wow, this is a big no-no for many companies. I still own and use thousands of TrueType fonts, and most of the companies I work with still have quite a number around. I’m definitely going to have to avoid this patch.

17. 

    woody November 14th, 2011 at 22:20

    @Carr -

    Keep an eye on this site to know when it’s OK to update. Except in rare cases, I have people avoid updating when the patches come out, then take a closer look toward the end of the month to see if everything’s going well. Also, if you follow me on Twitter @woodyleonhard, I always announce MS-DEFCON changes there.

18. 

    Carr November 15th, 2011 at 20:57

    thanks Woody .. have you already said yes or no to KB2641690?

19. 

    rc primak November 16th, 2011 at 00:21

    @pcguy —

    So just wait for the security companies to update their definitions. As a home user, I’ve already seen some response from my favorite free vendors.