Did yesterday's IE update affect SSL?

[Daniel Crichton]

Yesterday was a strange day for me. I had a customer ring and say they had a
problem in the checkout using SSL, when they tried to submit their order IE
popped up a "Page cannot be displayed" page. This in itself isn't strange,
it's happen a couple of times in the past, and each time it's either been
due to my web server having just been reloading or a problem with the
customer's settings (eg. firewall blocking SSL outbound), and it's on
average one call a month. Yesterday was different though. Yesterday I had 6
customers in an hour call, all with the same problem. I asked each of them
what they were running on their machines, and how they were connecting to
the internet. The only common factor was XP SP2 and Automatic Updates
enabled, and yesterday there was an update installed.

I've been through the web server pages and applications at my end. I've
trawled the logs, my firewall logs, and run packet monitoring apps and pored
over traces. I can't see anything that would suddenly cause problems, and
the pages and code haven't been changed for a few weeks. The "Page cannot be
displayed" isn't appearing on the same step in the checkout either, and in
one case was in a different web application. The problem seems to stem from
the last IE update.

Has anyone else been experiencing problems with viewing sites using SSL with
the new update installed?

Dan

 

[Daniel Crichton]

Just had another call. Definitely looks like the update that came out
yesterday. This customer is another XP SP2 user with Automatic Updates
enabled, but he was able to tell me it's not just my site he's had trouble
with, but other sites he's been buying from since yesterday, including
Amazon.

Dan

 

[RWS]

Just had another call. Definitely looks like the update that came out
yesterday. This customer is another XP SP2 user with Automatic Updates
enabled, but he was able to tell me it's not just my site he's had trouble
with, but other sites he's been buying from since yesterday, including
Amazon.

Dan

=============================================================
Maybe you could mention / provide a link to the web site you are talking
about -
Here is the information concerning the latest update:

You receive the Stop error "Stop 0x05 (INVALID_PROCESS_ATTACH_ATTEMPT)"
in Windows XP Service Pack 2 or Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;en-us;887742
=============================================================

 

[Daniel Crichton]

=============================================================
Maybe you could mention / provide a link to the web site you are talking
about -

https://www.bookfellas.co.uk

I can't reproduce the problem, even with 2 XP SP2 PCs that installed the
update yesterday. And as my followup message stated, we've had a customer
(and since then 2 more) who have told us it's not just our site they've had
problems with, but others too. And again, they have XP SP2 and Automatic
Updates enabled.

Here is the information concerning the latest update:

You receive the Stop error "Stop 0x05 (INVALID_PROCESS_ATTACH_ATTEMPT)"
in Windows XP Service Pack 2 or Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;en-us;887742
=============================================================

Are you sure that's the latest? That was on the download system back in
November.

This appears to be the latest security update:

http://www.microsoft.com/technet/security/bulletin/MS05-015.mspx

and it appears to affect SSL. I'm wondering if that might be the problem.

Dan

 

[jopa66]

Just tried your link - I get error message as below:


Microsoft VBScript compilation error '800a03ea'

Syntax error

/asp/log.inc, line 5

Select Case True
-------^

 

[RWS]

https://www.bookfellas.co.uk

I can't reproduce the problem, even with 2 XP SP2 PCs that installed the
update yesterday. And as my followup message stated, we've had a customer
(and since then 2 more) who have told us it's not just our site they've
had problems with, but others too. And again, they have XP SP2 and
Automatic Updates enabled.


Are you sure that's the latest? That was on the download system back in
November.

This appears to be the latest security update:

http://www.microsoft.com/technet/security/bulletin/MS05-015.mspx

and it appears to affect SSL. I'm wondering if that might be the problem.

Dan

================================================================
My Windows Update Installation History shows:

Microsoft Security Bulletin MS05-015
Vulnerability in Hyperlink Object Library Could Allow Remote Code Execution
(888113)
http://www.microsoft.com/technet/security/bulletin/MS05-015.mspx

was installed on Tuesday Feb 8, 2005 -

You receive the Stop error "Stop 0x05 (INVALID_PROCESS_ATTACH_ATTEMPT)"
in Windows XP Service Pack 2 or Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;en-us;887742

was installed on Wednesday Feb 23, 2005 -

There were several other updates installed between those two -
=================================================================

 

[Daniel Crichton]

================================================================
My Windows Update Installation History shows:

Microsoft Security Bulletin MS05-015
Vulnerability in Hyperlink Object Library Could Allow Remote Code
Execution (888113)
http://www.microsoft.com/technet/security/bulletin/MS05-015.mspx

was installed on Tuesday Feb 8, 2005 -

You receive the Stop error "Stop 0x05 (INVALID_PROCESS_ATTACH_ATTEMPT)"
in Windows XP Service Pack 2 or Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;en-us;887742

was installed on Wednesday Feb 23, 2005 -

There were several other updates installed between those two -
=================================================================

What does it show for Monday 21st and Tuesday Feb 22?

Dan

 

[RWS]

================================================================
My Windows Update Installation History shows:

Microsoft Security Bulletin MS05-015
Vulnerability in Hyperlink Object Library Could Allow Remote Code
Execution (888113)
http://www.microsoft.com/technet/security/bulletin/MS05-015.mspx

was installed on Tuesday Feb 8, 2005 -

You receive the Stop error "Stop 0x05 (INVALID_PROCESS_ATTACH_ATTEMPT)"
in Windows XP Service Pack 2 or Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;en-us;887742

was installed on Wednesday Feb 23, 2005 -

There were several other updates installed between those two -

=================================================================

I just tried going to https://www.bookfellas.co.uk/ and it came up OK for
me -

=================================================================

 

[Daniel Crichton]

Just tried your link - I get error message as below:


Microsoft VBScript compilation error '800a03ea'

Syntax error

You hit the site in the 20 second period that the my web author opened the
site in FrontPage to make a change and ASP threw syntax errors for every
page request until my automated checks kicked in and rebooted the server.
We've been getting some really strange problems with FrontPage recently -
I'm going to remove the extensions to prevent it doing that again.

Dan

 

[Daniel Crichton]

You receive the Stop error "Stop 0x05 (INVALID_PROCESS_ATTACH_ATTEMPT)"
in Windows XP Service Pack 2 or Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;en-us;887742

was installed on Wednesday Feb 23, 2005 -

There were several other updates installed between those two -
=================================================================

Just checked my 2 PCS, and the only update installed in the past 2 weeks has
been that latter one. I guess it's possible that it could be the culprit,
although it's only supposed to affect IIS.

Dan

 

[Daniel Crichton]

I just tried going to https://www.bookfellas.co.uk/ and it came up OK for
me -

As I said before, it's not repeatable on any particular url. It seems to be
intermittent, and most customers don't have a problem.

Dan

 

[Guest]

I noticed this problem sometime last week. It started after I downloaded
updates from Windows Update. I am running XP, SP2. I don't know about
"yesterday's" update, because one of the issues I have is that Windows Update
no longer works. I am unable to access secure sites that I have used many
times before. One example is the Walmart music downloads site. I can get on
the site but can't purchase downloads or even access my account. I seem to
have no trouble downloading updates from Symantec, though. I have been so
frustrated trying to get this to work that I haven't tried other sites such
as Amazon.

 

[RWS]

What does it show for Monday 21st and Tuesday Feb 22?

Dan

===============================================================================
As it happens, I do not show any updates installed on Monday 21 and Tuesday
Feb 22

Maybe there is a difference due to your being in the UK and my being in the
USA -

Here are my last 20 updates:

Update for Windows XP (KB887742) Successful Wednesday, February 23, 2005
Automatic Updates

Update for Windows Media Connect Successful Saturday, February 12, 2005
Windows Update website
Security Update for Microsoft .NET Framework, Version 1.1 Service Pack 1
(KB886903) Successful Tuesday, February 08, 2005 Windows Update website

Security Update for Windows XP (KB873333) Successful Tuesday, February 08,
2005 Windows Update website

Windows Malicious Software Removal Tool - February 2005 (KB890830)
Successful Tuesday, February 08, 2005 Windows Update website
Security Update for Windows XP (KB888113) Successful Tuesday, February 08,
2005 Windows Update website

Cumulative Security Update for Internet Explorer for Windows XP (KB867282)
Successful Tuesday, February 08, 2005 Windows Update website

Security Update for Windows XP (KB891781) Successful Tuesday, February 08,
2005 Windows Update website

Security Update for Windows XP (KB885250) Successful Tuesday, February 08,
2005 Windows Update website

Security Update for Windows Messenger (KB887472) Successful Tuesday,
February 08, 2005 Windows Update website

Security Update for Windows XP (KB890047) Successful Tuesday, February 08,
2005 Windows Update website

Security Update for Windows XP (KB888302) Successful Tuesday, February 08,
2005 Windows Update website

Microsoft .NET Framework 1.1 Service Pack 1 Successful Tuesday, February 08,
2005 Windows Update website
Cumulative Update for Outlook Express for Windows XP (KB887797) Successful
Monday, January 24, 2005 Windows Update website

Windows Media Player 10 Successful Monday, January 24, 2005 Windows Update
website
Microsoft Corporation - Sound - Creative AudioPCI (ES1371,ES1373) (WDM)
Successful Monday, January 24, 2005 Windows Update website

Update for Windows XP HighMAT Support in CD Writing Wizard (KB831240)
Successful Monday, January 24, 2005 Windows Update website

Microsoft .NET Framework version 1.1 Successful Monday, January 24, 2005
Windows Update website
Microsoft Windows Journal Viewer (Windows XP) Successful Monday, January 24,
2005 Windows Update website

Security Update for Windows XP (KB890175) Successful Sunday, January 23,
2005 Windows Update website
===============================================================================

 

[Daniel Crichton]

I noticed this problem sometime last week. It started after I downloaded
updates from Windows Update. I am running XP, SP2. I don't know about
"yesterday's" update, because one of the issues I have is that Windows
Update
no longer works. I am unable to access secure sites that I have used many
times before. One example is the Walmart music downloads site. I can get
on
the site but can't purchase downloads or even access my account. I seem
to
have no trouble downloading updates from Symantec, though. I have been so
frustrated trying to get this to work that I haven't tried other sites
such
as Amazon.

Any chance you could pull up your Windows Update installation history from
the Windows Update site, and post which patches were installed just before
you started having problems?

Also, could you go to https://www.bookfellas.co.uk , browse around, put
something in your basket, etc.? If you get a problem viewing a page, can you
copy the URL, close IE, open it again and go to the same URL and verify that
it does open?

I'm pretty sure an update has messed up something the SSL handling. Whether
it's from MS, or possibly some other software on the machine (a few of the
customers I have spoken to are running Norton Internet Security so I
suspected that at first, but at least one other has ZoneAlarm and no trace
of NIS).

Dan

 

[Daniel Crichton]

Here are my last 20 updates:

Thanks. From the fact that I only started getting phone calls yesterday,
that newest update for http.sys is looking more like the culprit. I wonder
if it's causing problems with third-party firewall software - I don't run
any on this PC or my home one, which might explain why I can't replicate it.

Dan

 

[Daniel Crichton]

I noticed this problem sometime last week. It started after I downloaded
updates from Windows Update. I am running XP, SP2. I don't know about
"yesterday's" update, because one of the issues I have is that Windows
Update
no longer works. I am unable to access secure sites that I have used many
times before. One example is the Walmart music downloads site. I can get
on
the site but can't purchase downloads or even access my account. I seem
to
have no trouble downloading updates from Symantec, though. I have been so
frustrated trying to get this to work that I haven't tried other sites
such
as Amazon.

Symantec updates? Are you running NIS? If so, was there an update for that
just before you started having problems? Have you tried turning off NIS? I'm
just wondering if the one person I've spoken to who has ZoneAlarm installed
might also have NIS and either not mentioned it or not realised it - here in
the UK most new PCs seem to come with NIS pre-installed.

Dan

 

[Guest]

I am not currently on the computer that has the problem. I will try what you
suggest tonight....

Yes, I am running NIS. Since I typically check for updates for everything
each time I log on, it is possible that there was a concurrent update done,
but I have tried disabling NIS, to no avail.

I have also tried turning off firewalls. I did everything the Windows Update
site recommended for the error message I get (0x80072EE2). Nothing has
worked, yet.

 

[Guest]

I am having the exact same problem and did do a Windows Update this week. I
too have XP and SP2 and about half of the sites I usually go to, I can no
longer access. I get a message "host on black list". I can get on Yahoo for
instance but not Google! I have turned off the SP2 firewall but the system
says I am still running a firewall and I can't figure out where that is
coming from. Any help would be appreciated!

 

[Guest]

Oddly enough I received a call from a client today that is having the same
exact problem. I also, verified the encryption level, security levels, added
the secure site to the trusted zone, reregistered the dlls, and still no joy.
Has anybody been able to uninstall Update for Windows XP (KB887742) and see
it that resolves the issue?

 

[Daniel Crichton]

Oddly enough I received a call from a client today that is having the same
exact problem. I also, verified the encryption level, security levels,
added
the secure site to the trusted zone, reregistered the dlls, and still no
joy.
Has anybody been able to uninstall Update for Windows XP (KB887742) and
see
it that resolves the issue?

Any chance you can find out if that client has Norton Internet Security?

Since Friday we have had zero calls about problems using our site. No new MS
updates came out, so I'm wondering if NIS had an update to solve the issue.
This is looking more and more like a NIS problem, maybe in conjunction with
the http.sys update - I don't have any machines with NIS on here that I can
test my theory with, nor do I know anyone who has NIS (the couple of friends
who did have it removed it some time ago).

Dan