KB 3092627 fixes bad Windows patch MS15-084/KB 3076895

There has been a lot of confusion surrounding the Aug. 11 security patch MS15-04/KB 3076895, which broke several products from Symantec, IBM, and even Microsoft itself. It took more than two weeks for Microsoft to recognize that the Patch Tuesday offering conflicted with the company’s own software, during which time Microsoft tech support continued to deny there were any problems, even when given thorough descriptions of the symptoms and an internal knowledge base link.

A hotfix, KB 3090303, was finally released Aug. 31 and seems to take care of the problem, but you had to know you had the problem, find the solution, then manually install the patch. Now Microsoft has made available KB 3092627, which is a re-release of the hotfix, this time made available through Windows Update.

According to its KB article:

If update 3090303 is installed, customers already have the fix for the issue. Therefore, they don’t have to install update 3092627. Update 3092627 is a broader GDR release of the fix in update 3090303.

(GDR is Microsoft-speak for General Distribution Release — a version intended to go out through Windows Update.)

It turns out Microsoft’s original description of the extent of the problem was in error. Symantec wrote to me to say that the impact on its products is much narrower than originally described:

Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition on-premise solutions were not affected. Microsoft released a security update that caused an issue with the Symantec Endpoint Protection Small Business Edition hosted offering, along with a few other vendor software suites. We have been working with Microsoft, and Microsoft has created a hotfix that customers can apply.

That hotfix has evolved into the GDR that was made available overnight.

The whole world is watching Microsoft’s patching capability, particularly in light of the Windows 10 forced-patching debacle. The company has had a good record for the past five months, but this patch casts doubt on Microsoft’s ongoing ability to release solid patches — even testing against Microsoft’s own Forefront Endpoint Protection apparently wasn’t adequate — to fix bad patches quickly and to keep customers informed along the way.

In fact, the only definitive information we received was from a buried Answers Forum post by an unidentified individual (eventtrac) who appeared to be in the know.