Patch/Configuration Management, Vulnerability Management

Microsoft fixes one July Patch Tuesday fix

Microsoft fixed one of its July patches this week after reports that the patch appears to install correctly, but then is reoffered by Automatic Update and Windows Update.

The patch had been released last Tuesday to fix a vulnerability in Internet Information Services (IIS) that use Active Server Pages that could allow remote code execution.

The original release was part of seven patches distributed by Microsoft as part of its monthly Patch Tuesday release cycle.

Issues with the patch occurred because of the way Windows Update determines which computers should be updated, according to an advisory released by Microsoft.

Windows Update then offers the update to PCs that have IIS common files installed, but do not have the Asp.dll binary.

In another issue, ISS also locks the Asp.dll file, preventing the update from installing correctly, according to the update.

Microsoft's hefty seven-patch release earlier this month followed a record-setting 12-patch distribution in June.

Recently the monthly release schedule has been the target of malicious users who have used exploit code to target flaws in Microsoft Office applications in the days following the release.

A Microsoft spokesman offered a post on the Microsoft Security Response Center blog as a statement. It advised Windows Service Pack 1 users to rerun detection to make sure their systems have updated correctly.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.