FYI...

- http://isc.sans.org/diary.php?date=2004-08-10
Updated August 10th 2004 22:07 UTC
"Windows XP Service Pack 2 was officially released to the world yesterday...While most users should not have significant problems with SP2, others stumble upon cases where home grown web applications or other 3rd party software may not work properly after installation. The Internet Storm Center has set up a forum to collect the experiences of others in the security community. It is the hope of the ISC that users will be able to share information on problems they have encountered and/or steps they used to help remedy these issues. If you would like to submit your experiences, please see the following URL..."

>>> http://isc.sans.org/xpsp2.php

.

As of date/time of this post, 11% of respondants had serious trouble:

"Big problems, could not use/install" (5%):
- http://isc.sans.org/xpsp2.php?ratingsearch=4

"Had to rebuild system" (6%):
- http://isc.sans.org/xpsp2.php?ratingsearch=5


.

An extention of ISC diary for today ( http://isc.sans.org/xpsp2summary.php ) references this long list of...

"Programs that may behave differently in Windows XP Service Pack 2"
- http://support.microsoft.com/default.aspx?kbid=884130&product=windowsxpsp2
8/10/2004
"XP Service Pack 2 (SP2) introduces a number of new features that help increase the performance and the security of your system. These changes also affect the operations and functionality of some programs..."

...very worthwhile and interesting read.

.

As of date/time of this post, now 14% (and rising) had serious trouble (633 respondants):

"Big problems, could not use/install" (8%):
- http://isc.sans.org/xpsp2.php?ratingsearch=4

"Had to rebuild system" (6%):
- http://isc.sans.org/xpsp2.php?ratingsearch=5

FYI...

M$ To Release WinXP/SP2 To Home Users 08.18.2004...about 80MB size
- http://finance.myway.com/jsp/nw/nwdt_rt.jsp?section=news&feed=dji&src=704&news_id=dji-00020220040817&date=20040817
Tuesday August 17, 6:43 AM EDT
"Microsoft told BBC News Online its SP2 security patch will be put on servers that automatically update home PCs as from Wednesday. The consumer version is smaller than the business edition released to corporate customers...For consumers, SP2 is expected to be about 80 megabytes but it could vary in size depending on how up to date with patches a user's machine is. Microsoft hopes to get SP2 on to 100 million machines in the next couple of months. By the end of the month users of XP Professional will get a version tailored for them. Early reports suggest that SP2 can cause problems..."

.

FYI...

Microsoft Delays SP2 Auto Update For Enterprises
- http://www.techweb.com/wire/story/TWB20040817S0003
TechWeb News - August 17, 2004 (1:34 p.m. EST)
"Although Monday was to be the day when Microsoft began pushing Windows XP Service Pack 2 (SP2) to enterprises, it changed its mind at the last minute and delayed the automatic updating for more than a week...Users of Windows XP Home Edition, however, who have enabled Automatic Update will begin to receive SP2 Wednesday, August 18. The delay likely won't bother many businesses, who are busy testing the upgrade before rolling it out to desktops. Analysts have generally recommended caution on SP2 as well. Last week, for instance, Gartner analysts advised enterprises to wait at least two months before deploying the OS update."

.

Choose your poison:

WinXP/SP2 Home Available On AutoUpdate Aug. 18
- http://www.crn.com/showArticle.jhtml?articleId=29101607&printableArticle=true
"...Nortec recommends that businesses test Windows XP Service Pack 2 as soon as it is available and plan a rapid deployment. Prior Microsoft updates have been reverse-engineered, and within as little as 20 days, exploits were available and used to attack unpatched systems. While Windows XP Service Pack 2 may cause compatibility trouble, it appears that most of that trouble will be with home systems."

- http://www4.gartner.com/DisplayDocument?ref=g_search&id=453882
"...Mainstream enterprises should plan to wait at least two months after SP2 ships before beginning deployment..."

.

FYI...

As of date/time of this post, (with 758 respondants) now 15% (on the rise) had serious trouble:
- http://isc.sans.org/xpsp2.php

...just keeping score, folks. 'Still free to choose.

.

FYI...

IE Flaw Affects Windows XP SP2 Systems
- http://www.techweb.com/wire/story/TWB20040820S0004
August 20, 2004 - By Gregg Keizer, TechWeb News
"Another flaw in Internet Explorer has been uncovered by Danish security firm Secunia, which said that the gaffe left all users open to attack, even those who had updated Windows XP with the massive Service Pack 2 upgrade...
( http://secunia.com/advisories/12321/ )
Microsoft just began sending Service Pack 2 (SP2) to Windows XP Home users this week, and although the update has been touted as a major security upgrade, the Secunia alert isn't the first problem that SP2 has faced. Microsoft has already issued a hotfix to SP2 that addresses problems some virtual private network (VPN) users have encountered..."
>>> http://support.microsoft.com/default.aspx?scid=kb;%5bLN%5d;884020
"...Prerequisites
This hotfix requires Windows XP Service Pack 2 (SP2)..."

.

FYI...

New Download.Ject Attack Serves Up Porn
- http://www.securitypipeline.com/showArticle.jhtml?articleId=29116709&printableArticle=true
August 20, 2004
"A new version of June's Download.Ject attack is hitting users through a pair of instant messaging services, planting backdoors on fully-patched Windows XP PCs, and serving victims with a diet of porn ads. According to Thor Larholm, a senior security researcher at Newport Beach, Calif.-based PivX Solutions, the new attack is probably the work of the same group of hackers who launched the original Download.Ject assault in June...This attack, said Larholm, is different. "The attacks comes in via AIM or ICQ instant messages, either from random users or users you may know," he said. If the users clicks on the link that reads "My personal home page http://XXXXXXX.X-XXXXXX.XXX/" the server attempts to download the Trojan using several IE vulnerabilities, including Object Data, Ibiza CHM, and MHTML Redirect, he added...Larholm said that a fully-patched edition of Internet Explorer 6 running on Windows XP SP1 can be compromised by this newest attack, but that machines which have been updated with Windows XP Service Pack 2 (SP2) are safe..."

.

FYI...

More Vendors Report SP2 Woes
- http://www.crn.com/showArticle.jhtml?articleID=29116619&flatPage=true
Aug. 20, 2004
"Glitches between Windows XP Service Pack 2 and critical applications continue to emerge...McAfee...Symantec...Groove Networks...SonicWall..."

.

http://www.apluswebmaster.net/hub-one.html

COOL SITE!!

FYI...('seems even they know this gets ugly):

...(How to) Recover your computer if the WinXP SP2 Setup program is not completed successfully
- http://support.microsoft.com/default.aspx?scid=kb;en-us;875355
...applies to:

* Microsoft Windows XP Professional Service Pack 2 (SP2)
* Microsoft Windows XP Home Edition Service Pack 2 (SP2)
* Microsoft Windows XP Media Center Edition Service Pack 2 (SP2)
* Microsoft Windows XP Tablet PC Edition 2005

.

FYI...

Microsoft: Use Script to Block Windows XP SP2 Update
- http://www.techweb.com/wire/story/TWB20040823S0010
August 23, 2004 - TechWeb News
"Microsoft has offered up yet another way for businesses to block the automatic update of Windows XP to the big-deal Service Pack 2 (SP2) upgrade. The Redmond, Wash.-based developer posted a copy-and-paste script to its TechNet Web site that lets administrators block or unblock specific PCs from receiving SP2 via Windows Automatic Update or the Windows Update Web site. The script, said Microsoft, used uses the StdRegProv class of the Windows Management Instrumentation Registry provider to enable or disable access to SP2 via either of those update mechanisms. To use the script, administrators must create a comma-delimited file that lists each desktop or server, by name, along with a “b” for block or “u” for unblock. The script code, available here, can be copied from and pasted into Notepad, then run as a .vbs file..."

>>> http://www.microsoft.com/technet/scriptcenter/solutions/blockxpsp2-multi.mspx
"...The ability to block delivery of Windows XP SP2 will be available for a limited time only. Please see http://www.microsoft.com/technet/winxpsp2 for information on the expiration date. For details on temporarily disabling delivery of Service Pack 2 through Windows Update and Automatic Updates, please see http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2aumng.mspx ..."

.

FYI...

Some programs seem to stop working after you install WinXP SP2
- http://support.microsoft.com/default.aspx?scid=kb;[LN];842242
"...applies to:
* Microsoft Windows XP Professional Service Pack 2 (SP2)
* Microsoft Windows XP Home Edition Service Pack 2 (SP2)
>>> Last Reviewed: 8/23/2004 (4.0) ..."

.