Re: Microsoft Security Bulletin MS01-030

From: Michael Bryan (btraqat_private)
Date: Wed Jun 13 2001 - 17:25:18 PDT

  • Next message: Ben Laurie: "Re: Bugtraq ID 2503 : Apache Artificially Long Slash Path Directory Listing Exploit"

    John Hanks wrote:
    > 
    > Does anyone know if a third version is in the works or if I should keep
    > trying to make the second version work on my machines?
    
    
    MS just released version 3 of that Security Bulletin, with a 3rd "official"
    version of the patch for W2K.  Again, the URL for the bulletin is here:
    
        http://www.microsoft.com/technet/security/bulletin/MS01-030.asp
    
    Under "technical description", it includes this new paragraph:
    
    ====
    On June 12, 2001 Microsoft discovered that the updated Exchange 2000 patch
    contained outdated files. We have corrected the error and provided an updated
    version of this patch for Exchange 2000. We recommend that all customers who
    have downloaded the Exchange 2000 patch prior to June 12, 2001 install the
    updated version. 
    ====
    
    
    At this point, I'd be hesitant to install -any- patch on this issue, until
    some brave souls have verified that the third time really is a charm.  Looks
    like they rushed it a bit too much this time, unfortunately.
    
    
    I would personally advise any exchange admin to subscribe to the MS Security
    Bulletin mailing list, in order to get this type of info as quickly as possible.
    Information is here:
    
    http://www.microsoft.com/technet/security/notify.asp
    



    This archive was generated by hypermail 2b30 : Thu Jun 14 2001 - 10:17:26 PDT