MS06-049 Causing Silent Data Corruption
Uncle Mike writes "It looks like there is a problem with the recently released MS06-049 / KB920958 patch. If you have compression activated on any folder, then the compressed data is at risk from corruption. New files that are close to a multiple of 4K in size will have their last 4,000 bytes or so overwritten with 0xDF. Although this problem has been reported to Microsoft, as yet there appears to have been no official announcement.
"
its interesting how when they make a patch that corrupts your data you dont hear anything from them.. but when someone makes a program to allow fair use by opening DRM on their movies they come up with a CRITICAL patch within ours to prevent it. i think that speaks to their priorities, protecting their drm IMPORTANT protecting your data hmm.. not so important
What type of programmer puts such possibilities or leaks in a program? I have been programming for a long time and I never had stuff like this happening. Data integrity is one of the primary things you want to maintain and you should be extra careful when handling and altering files not your own.
Custom electronics and digital signage for your business: www.evcircuits.com
If data is being silently corrupted, is there a problem if no one can hear it? That could explain Microsoft's silence.
assuming you're using Windows
It has been confirmed that either turning off the compression attribute (disk space permitting) OR uninstalling KB920958 will prevent further loss of data.
be sure to place your music files in compressed folders and let the 'evidence' self destruct at the hands of thine OS...
As is often pointed out on slashdot, this is why it's so important to have a good backup plan. Like most slashdotters, I recommend RAID.
So MS let loose with a Silent But Deadly Data Corruption.
"close to a multiple of 4K in size"
How close is close? Is 162k close to 164k? Sounds like it is to me. From the examples in the discussion cited, it seems that anything over 4k is at risk, not just things 'near' a 4k boundary.
I would even hazzard to guess that the size matters not at all, but rather the contents of the files. If the contents match a certain pattern, the compression goes awry and adds the garbage to the end. (Accidentally overwriting the real data.)
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
Tagline's wrong, compression and encryption are two very different things!
And BTW, I got this same story rejected last week. Fuckers.
Well, it's interesting that 0xDF0xDF0xDF0xDF0xDF0xDF0xDF0xDF0xDF0xDF0xDF0xDF0x DF0xDF0xDF0xDF0xDF0xDF0xDF
= Grow a brain...
nicknamed (0x)DF aka Data F**ker
Human ones.
;)
Have you never had a bug in software you've released?
If yes, you are human and fallible just like the poor sods who should get their bums kicked for this stuff up.
If no, then either you aren't telling the whole truth or I have to welcome you as our new alien overlord etc etc etc
--I thought I was wrong once, but I was mistaken.
this reminds me of a virus for the Amiga computer that replaced all the files content with the word LAMMER :)
Jorge
http://www.retroreview.com
I've never heard Windows called MS06-049 before...
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
Good troll.
He tried to kill me with a forklift!
The summary blurb is rather cryptic. MS06-049 is a patch to... what? Just Windows 2000 or XP too? And this was a patch for some vulnerability, assumedly? Which?
After a bit of research, here's what should have been included: MS06-049 was an elevation of privledge issue discovered in the kernel of Windows 2000 SP4 only. The patch for the issue, KB920958, appears to have a bug resulting in corruption of compressed folder.
The title is misleading as well. MS06-649 is the issue and KB920958 is the patch; the patch is what's causing the corruption, not the original issue.
If other replies to you have accurately guessed the truth and, as they say, you've never worked on a complicated piece of code, I will save you from spending any more "long time" working on your programming. Here is the program you're trying to make:
The AACS key is NOT 0xF606EEFD628B1CA427BEA93A9CA9773F
In the modern age where hard disk space can be had for so cheap, why would you even want to bother with disk based data compression?
I use compression on folders in XP Pro. and Home SP2. I have not seen this problem on my systems at home and work. I always get the newest patches on their first release dates. I even defragged (PerfectDisk v6.0 with its patches) over the weekend. I haven't seen anything odd. I am using old IDE and SATA HDDs.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
MS products have been corrupting data esp. with respect to compression for a LONG TIME. They still haven't learned from the Doublespace issues of the past... Proof of the old saw, the more things change, the more they stay the same...
Now I bet if the compression had anything to do with DRM there'd already be a patch for it!
'Ooooer Denis, there's a lovely bit of filth down 'ere!'...'Now we see the 'corruption' in the system!' ;)
if I claimed I was emperor just because some watery tart lobbed a scimitar at me they'd put me away!
Those files were important! Sheißßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
What're your customers going to do?
Deleted
maybe one patch was just easier to write.
--
Carnage Blender : Meet interesting people. Kill them.
http://support.microsoft.com/?kbid=920958
n /MS06-049.mspx
http://www.microsoft.com/technet/security/Bulleti
Someone figure out how to apply this problem to Windows Media DRM and we'll get a fix in no time!
'Yes, firefox is indeed greater than women. Can women block pops up for you? No. Can Firefox show you naked women? Yes.'
...similar to their (in)famous debug version of the new operator (IIRC generates guard bytes set to 0xCDCDCDCD).
While they are doubtlessly not releasing images with debug info, they might be using an overriden new operator that does something similar (for a variety of reasons).
It is hard to say, but this type of error - while *not* acceptable, *is* understandable,
I am very small, utmostly microscopic.
As of two minutes ago a search on http://search.microsoft.com/results.aspx?q=KB92095 8&l=2&mkt=en-US&FORM=QBME2 showed no reference to data corruption. Any tech journalists reading this?
-- Anthony Staines
The Usenet discussion seems to indicate 5 users having problems on 14 servers - hardly "countless". While it doesn't mean that it doesn't happen, it does seem odd that there haven't been lots of reports since Augist 24th. I'd have expected that (since it was originally reported in Thumbnail JPGs) that people would quickly notice corruption. Maybe no-one is using compressed folders out there?
It seems like the problem is only for 2000 according to this reply.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
nt
Because Windows was not properly written, one or more of your disks may have errors on it.
To avoid seeing this message again, get a Mac.
Here I am losing my geek license twice today; first by not knowing ^H and now by not knowing what the heck a Beowulf Cluster is and yet referencing it.
As a matter of policy, Microsoft generally doesn't fix bugs in already released software, with the exceptions of publicly known security flaws (and then only once a monthg), service packs (notice WinME has had zero service packs), and $50 hotfixes. Since Microsoft now depends on returning customers more than new customers, and their customers have little chance of switching vendors, they have every motivation to make older versions as unpalatable as possible.
I personally haven't seen any files corrupted though. We'd see much more than a few newsgroup postings if this was a widespread problem.
My pure guess based on /. comments:
How can this happen? Loop counting error. Probably from integer division of the file size/ 4K chunks.
Allocator did it right, loop missed the last chunk. Very common. Typically a novice error. But can blindside even experienced ones. QA should have nailed it.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
It just figures a Zaku would cause this kind of trouble...
Is anyone out there seriously using disk compression in a production environment? Didn't anyone teach you guys that disk compression is a crutch and not a solution? For as long as I've been working with servers, all of my mentors have led me to believe that it is pretty much generally accepted practice not to use disk compression due to the potential for data corruption and the performance hit your servers take. If you need to compress files to save space, throw them onto some LTO or DLT media and pull them completely offline.
If you're working for a company that can't come up with more money for disk space, maybe you need to click on the Dice.com adds that are all over /. here.
I just installed a *bunch* of Windows XP patches on my Mac Pro last night. Hey, just 'cuz it's a Mac doesn't mean I want the XP installation on a second hard drive in it to be unpatched!
But yeah, yeah... I got the joke.
With 300G drives costing less then $100, what type of cheap bastard uses file compression? //in my day we had 10M hard drives - and we LIKED IT!
The EU should force them to mention it in their advertising when they shout it out for having such a reliable OS.
Since the advertising is in great conflict with the EULA.
Just like the "Smoking can cause cancer":
"Using this or other Microsoft products can cause critical data loss, system instability and significant loss of profit for any reason, Microsoft accepts absolutely no responsibility."
Who says anything is corrupted? It may just be protected, really, really well. Perhaps it's part of MS's new security consciousness.
Maybe if you can prove that you are a good and loyal customer, MS might give you the DRM key you need to read those files.
Hey, the issue only affects Win2K, users who run WinXP can move along, nothing to see here! Any square who's running Win2K and not XP deserves this kind of thing. I mean, your data is at risk running that flaky old PoS. Very soon now, Microsoft will release the shiny new Vista, and then you wouldn't want to be caught dead running something as aniquated as Win2K!!
I think this failed patch is a perfect reason for you to go out and upgrade your Windows.
DOD
Oh god, that woman is John Romero!
...Hard drive compresses you!
Just did a re-read of this and it seems the significant digits are the same as one of the prominent Canadian Lotteries. Is this coincidence or does it say something of the likelihood of you getting your data back. .-.-. -.- .--- ...-.-
This is completely unacceptaLAMER!LAMER!LAMER!LAMER!...
http://outcampaign.org/
... makes such massive changes to the VM of a stable kernel that allows this sort of thing to happen in the first place?
Oh wait...
http://outcampaign.org/
I just added a new SCSI storage array to our server here and this seems to only affect compressed files copied to the external storage array and not my existing compressed volumes. 2 weeks and 5 Dell technicians (who have worked very hard with me to figure out what was going on) and I only found out about this today from a short posting on Microsoft's newsgroups. I uninstalled said KB, and I'm instantly back in business. MS needs to fix this fast, as corruption of unique data is the number 1 IT sin. Thank god we have multiple levels of backups.
Loop counting errors can be known as a "heuristic fencepost error," one of my favourite error names, next to "bad magic number."
In essence, "Count a fence's posts, then loop using the number of joins between the posts as a counter. You will miss one fence post."
http://pcblues.com - Digits and Wood
Windows ate my homework.
remember to loot and pillage before you burn!
Stop it. I'm watching you.
Your friend in the sky,
God