Slashdot Mirror

← Back to Stories (view on slashdot.org)

.ANI Vulnerability Patch Breaks Applications

Posted by CmdrTaco on from the this-is-only-gonna-hurt-twice dept.

Jud writes "Microsoft's fix for the .ANI vulnerability was part of Patch Tuesday yesterday. However, all is not well with the update. Reportedly, installing the patch will break applications such as Realtek HD Audio Control Panel and CD-Tag, which mentions they are affected by the problem on their main page. A hotfix is currently available from Microsoft, however their current position is this is an isolated problem and the fix is not planned to be pushed out through Microsoft Update. "

4 of 164 comments (clear)

  1. Re:Hehe by mwvdlee · · Score: 4, Interesting

    They released a patch yesterday, discovered problems with it since yesterday then fixed it today. Yet you've been hearing about these problems for weeks?

    --
    Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
  2. Re:Before all the lame bashing.. by afidel · · Score: 3, Interesting

    Useless feature??!?

    Uh, several of our enterprise webapps used animated cursors to let the user know that something is being processed. Maybe to a clueless geek user feedback is a useless feature, but to anyone who knows about UI design it is a requirement. The real sin with this patch is that this bug was already patched TWO years ago, but they meerly patched the codepath for the known vulnerability and left it at that, they did not look at the actual cause of the problem and so we have the same vulnerability with a twist come out two years later.

    --
    There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
  3. Re:Hehe by adisakp · · Score: 3, Interesting

    "their current position is this is an isolated problem"

    I have a fairly new Dell XPS600 (1 year old) and the update borked my machine due to the realtek program. I got some obscure message about how rtdcpl.exe was performing an illegal access trying to move some OCX DLL.

    I was able to solve the problem by Google Searching and installing the MS hotfix. The only problem now is that "hotfix" makes it so I have to wait about 1 minute longer after I log in before I can access the internet. I used to be able to pop-up IE right away and surf but now if I do that, I get the error page for site not found for about 1 minute before things start working normally.

    I don't know how isolated it can be since Dell alone has sold millions of PC's with realtek audio chipsets.

  4. Was the DLL base address ALL they changed!? by Anonymous Coward · · Score: 3, Interesting

    What bothers me is that it makes me feel like this "fix" may not even patch the real problem.

    You see, moving where a DLL is stored in memory might break the proof of concept, but it might not actually fix the vulnerability. Sure, the code it hooked into before in order to hack the machine won't be in the same place, but it might well be possible to fix the exploit to point to the code's new location.

    In short, I wonder if they're playing tricks to make it more difficult to exploit without actually fixing the underlying problem?