MS-DEFCON 4: Apply all patches except the .NET updates

It’s time to get patched up, but watch out for one giant collection of problems, disguised as updates.

Susan Bradley, in her June 24 article in Windows Secrets Newsletter, talks about the pain of trying to keep up-to-date with .NET patches. I’ve always disliked .NET and detested .NET patching – the people who put together the patches have created an unholy mess. Susan gives a few of the details.

So I’m going to suggest you apply all of the currently outstanding Windows and Office patches, EXCEPT the .NET patches. Susan lists them as:

KB 982670 ,KB 982524 for Windows XP and Windows Server 2003, KB 982525 for Vista and Server 2008, and KB 982526 for Win7 and Windows Server 2008 R2. She also mentions KB  956250. I hate to do this to you, but when you go into Microsoft Update or Windows Update, jot down all of those numbers and DON’T apply those updates.

There isn’t a single .NET update that’s of any significance. (One could argue that there haven’t been any real improvements in .NET patches in many moons – only added headaches.)

So get patched up now. And if you use Windows XP, see the next blog item to run a little fixit that’ll protect you from a 0day that (in my opinion) is way overblown.

I’m rolling us down to MS-DEFCON 4: There are isolated problems with current patches, but they are well-known and documented here. Check this site to see if you’re affected and if things look OK, go ahead and patch.