Last WMF patch has been rebooting your machines unexpectantly

MadRat

Lifer
Oct 14, 1999
11,999
308
126
Does Windows Patch Without Permission?

Excerpt:

"Does Windows Patch Without Permission?

Posted on 01/09/2006 @ 16:05:33 in Vulnerabilities.

Microsoft's relatively quick response to the WMF fiasco may have been a bit too quick. In the midst of a debate at Ars Technica over Microsoft's personal-best performance in handling the WMF exploit, a few quiet voices popped up. Zakharov:

Is it me or was that patch distributed with some kind of hidden higher priority? I normally leave windows auto-update set to notify me when patches are downloaded for manual installation but the WMF patch took matters into its own hands and installed itself with a reboot.

According to Microsoft's documentation for Automatic Update, that shouldn't happen to an Administrative user: "If you are an administrator for your computer, you can delay the restart; otherwise, Windows warns you and then restarts your computer for you. Make sure you save your work and remind other users to save their work, especially before scheduled installation times."

After Zakharov's comment, one of our techs concurred. He noticed that one of our XP laptops that was set to simply download updates had restarted... And had the patch.

Meanwhile, astrashe, another Ars Technica member agreed with Zakharov:

I noticed the same thing. I got a message saying the patch had been installed, and that my machine had rebooted.

You may well ask, "What's the problem? You got protected, didn't you?"

Quite true. However, it's one thing for your neighbor to knock on your door, then wait for an invitation to enter. It is quite another for your neighbor to barge in and start moving furniture while you're entertaining guests at your pool party. And it's especially troublesome when your neighbor walks in uninvited, using the keys you trusted him to use only when authorized.

We were frankly astounded that Microsoft might be so bold..."
 

EatSpam

Diamond Member
May 1, 2005
6,423
0
0
Hmm... my machine didn't reboot, but all my machines update with WSUS, so that could be the difference.
 

judasmachine

Diamond Member
Sep 15, 2002
8,515
3
81
yeah if you had been working at the time, it could have wiped it out. however i went and updated myself as soon as i heard there was a patch. i don't remember if it restarted or not, but it probably did as i would have restarted anyway.
 

SagaLore

Elite Member
Dec 18, 2001
24,036
21
81
If this is true, that means there are hidden "features" in Windows Update that we don't know about. Most likely exploitable features if you know what flags to use.
 

Genx87

Lifer
Apr 8, 2002
41,091
513
126
Originally posted by: EatSpam
Hmm... my machine didn't reboot, but all my machines update with WSUS, so that could be the difference.

I bet it is, WSUS updates can be delayed if a user is logged in, but if nobody is logged in the machine will be rebooted automatically.

btw every machine on our network I authorized this patch for had to be manually rebooted when users were logged in.