Threat Level: green Handler on Duty: Didier Stevens

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

WSUS issues?

Published: 2007-11-12
Last Updated: 2007-11-12 22:36:35 UTC
by Jim Clausing (Version: 4)
0 comment(s)

We've received several reports this morning of folks getting SQL errors from WSUS after synchronizing.  The error suggests some sort of problem in the new product metadata.  One report suggested it might be US only, but some forum postings elsewhere suggest that it might be hitting the UK, too, so I wouldn't count on it being limited geographically.  We've pinged our Microsoft contacts, but not heard back from them yet.  We'll update as more info becomes available.  Thanx to Mark and Dennis for bringing this to our attention.

Update:  (2007-11-12-17:20 UTC) We've received the following info on a possible workaround, until Microsoft issues an update.  Use at your own risk and realize that another sync will probably overwrite the change.

"You can fix the problem by going into the database:

In both 'tbPreComputedLocalizedProperty' and
'tbPrecomputedCategoryLocalizedProperty', find the following row (using the
Title field):

'ISA Server codename "Nitrogen", Definition Updates for HTTP Malware
Protection'

Remove the double quotes."

Reference:

http://www.wsus.info/forums/index.php?showtopic=11125&view=findpost&p=39338

 

Update 2:  (2007-11-12-18:40 UTC) The following was posted on a technet forum by Paul Shapiro giving the actual SQL to accomplish the workaround from update 1.  Thanx to Susan and Dennis for pointing this out.

 

The following SQL statements will make those updates, removing the
double-quote character. It's hard to see here, but the 2nd argument to the
Replace function is single-quote, double-quote, single-quote. The 3rd
argument is single-quote, single-quote.

Update tbPrecomputedCategoryLocalizedProperty
Set Title = Replace(Title, '"', '')
Where Title like '%"Nitrogen"%'

Update tbPreComputedLocalizedProperty
Set Title = Replace(Title, '"', '')
Where Title like '%"Nitrogen"%'

If you want to more generally eliminate all double-quotes from any title,
instead of just the one we now know is a problem today, you could use this
instead:

Update tbPrecomputedCategoryLocalizedProperty
Set Title = Replace(Title, '"', '')
Where Title like '%"%'

Update tbPreComputedLocalizedProperty
Set Title = Replace(Title, '"', '')
Where Title like '%"%'

 

Update 3:  (2007-11-12-22:40 UTC) Hopefully this will be the final update.  We have now received reports that Microsoft has withdrawn or expired the update that caused the problem, so syncs should work again.

Keywords:
0 comment(s)
Diary Archives