Microsoft pulls faulty patch, plans re-release

A critical vulnerability affecting Microsoft Windows 2000 Server running Windows Media Services will remain unfixed until Microsoft re-releases a patch for it, the company said last Friday.

A patch for the hole, which could allow an attacker to take control of a system, was released during Patch Tuesday last week. However, Microsoft pulled the patch this week because it failed to work.

"Shortly after we released the update we received several reports that it did not protect against the vulnerability reported to us. At that time, we pulled the update and notified customers," Jerry Bryant, group manager of response communications for the Microsoft Security Response Center, wrote in a blog post last Friday afternoon. "The main reason for pulling the update was to save a reboot for customers who had not yet installed it. The original issue was missed due to focusing on a variant of the original report early in the investigation. We are addressing this issue and plan to re-release the update next week."

When the fixed patch is ready, Microsoft says it will notify customers via its Twitter account @MSFTSecResponse and since the update will go out as a major revision to the bulletin, there will be no advance notification mailer, although subscribers to the company's comprehensive notification service will receive an e-mail, Bryant said.

Asked last Friday for details on why the patch did not work and what day it will be available, a representative said in a statement: "We cannot give a specific day yet, but we are planning to re-release the update next week. That is our first priority right now. After that, we will be able to investigate the issue further."

Bryant initially notified customers in a blog post last Wednesday that the security update for MS10-025 was being withdrawn.

"We are not aware of any active attacks seeking to exploit this issue and are targeting a re-release of the update for next week," he wrote. "Customers should review the bulletin for mitigations and workarounds, and those with Internet-facing systems with Windows Media Services installed should evaluate and use firewall best practices to limit their overall exposure."

This is the second time in about two months that the software giant has had issues with a security patch it released. In February, a security update crashed some Windows systems because they were infected with a rootkit program that made changes to the operating-system kernel.

Other companies have problems of their own with updates. Earlier this week, a buggy McAfee antivirus update caused tens of thousands of Windows XP computers to crash or repeatedly reboot. McAfee issued a public apology to customers for the problem late Thursday.

This article was first published as a blog post on CNET News.