MS10-015 could be a bad MS patch

Usage and Config Patch
1

(imported topic written by ggerling91)

FYI

We tried it on a few machines and did not seem to have any issues.

2

(imported comment written by BenKus)

We also haven’t heard of this issue for any customers yet, but we have seen the articles…

Ben

3

(imported comment written by ktm_200091)

Anyone having issues here?? I’ve been a wimp and didn’t include it in when sending patches to my early adopters test group.

4

(imported comment written by cstoneba)

We pushed it to our test group of workstations (50 boxes) and test servers (40 boxes) and saw no issues. Then the reports came out that it was bad so I removed it from all our baselines and haven’t touched it since. I’m still waiting for MS to say that the issue has been fixed (if there really is one…)

5

(imported comment written by BenKus)

Looks like the BSOD would only occur if you had a computer infected with a specific rootkit:

http://threatpost.com/en_us/blogs/ms10-015-restart-issues-are-result-rootkit-infection-021810

Ben

6

(imported comment written by cstoneba)

Any chance that BF can modify the fixlet to not be applicable on machines with the wrong version of atapi.sys?

7

(imported comment written by SystemAdmin)

Is BigFix going to update the fixlet for MS10-015 to use the new version of the patch that Microsoft released on 03-02-2010? It is supposed to include a rootkit detection scheme in it. Thanks.

8

(imported comment written by liuhoting91)

Microsoft didn’t actually release a new version of the patch according to it’s release notes on MS10-015 on 3-2-2010. According to the FAQ, the only thing the change affects patches that customers receive through Windows Updates only. The actual patch binary behavior is unchanged.

There’s been no change to the actual sha1 of the XP MS10-015 patches since it was published. If the actual patch binary changes, we’ll make the appropriate modifications in our fixlets.