Security Update MS16-023 installs new “Get Windows 10” functionality

[Batu69]

Mixing security updates with non-security content is never a good idea, but it is particularly worrisome when Microsoft pushes new "get Windows 10" functionality on Windows 7 and 8.1 systems that one cannot get rid of without removing the security update itself as well.

 

Security update MS16-023, released as part of the March 2016 Microsoft Patch Day, looks on first flance like any other security update Microsoft released for one of its operating systems.

 

In its summary, Microsoft notes that it "resolves several reported vulnerabilities in Internet Explorer", of which the most severe "could allow remote code execution" if users open web pages that were created to exploit the vulnerabilities.

 

 

If you read on, you will notice that the patch includes non-security fixes as well.

Quote

This security update resolves several reported vulnerabilities in Internet Explorer. The most severe of these vulnerabilities could allow remote code execution if a user views a specially crafted webpage in Internet Explorer. To learn more about these vulnerabilities, see Microsoft Security Bulletin MS16-023.

Additionally, this security update includes several nonsecurity-related fixes for Internet Explorer.

 

To find out more about these non-security related fixes, one needs to scroll down on the page where they are all listed:

• 3144816 XSS filter breaks submission of token for ADAL authentication in Internet Explorer 11
• 3144520 Poor performance in Internet Explorer 11 when you enter characters in text field
• 3144521 Internet Explorer 11 is closed when you use F12 Developer Tools
• 3144522 Users can't access Internet because proxy settings are overwritten in Internet Explorer 11
• 3144523 Empty textarea loses its closing tag in Internet Explorer 11 after conversion from XML to HTML
• 3146449 Updated Internet Explorer 11 capabilities to upgrade Windows 8.1 and Windows 7

 

Of specific interest is KB3146449, which as it happens is the only KB entry of the six that is linked improperly.

 

 

When you open the right page, you find the following information:

Quote

This update adds functionality to Internet Explorer 11 on some computers that lets users learn about Windows 10 or start an upgrade to Windows 10.

 

Microsoft does not reveal what this means, or what this has to do with Internet Explorer. According to Woody Leonhard over at Infoworld, the update pushes a banner on Internet Explorer 11's New Tab Page advertising the company's new operating system Windows 10.

 

This appears to be only the case for non-domain joined machines, and the banner is not displayed on all systems the update is installed on.

 

The big, big problem

 

The main issue with pushing Windows 10 offers this way is that users cannot remove them from their system as KB3146449 does not appear in the list of installed updates for the system as it is integrated into KB3139929.

 

This means that one would have to remove the security updates as well to get rid of the advertisement for Windows 10 on the computer.

Obviously, not using Internet Explorer would resolve the issue as well, but this may not always be possible and only a temporary solution as Microsoft may be inclined to push Windows 10 offers to other programs or tools of the operating system in the future.

 

What now?

 

Apart from regularly updating updates so that they are pushed anew to user systems to bring along with them the dreaded "Get Windows 10" offer again, Microsoft seems to have made the decision to  tighten the screws even more by pushing the offer to its Internet Explorer browser as well.

 

If you think that this is the end of it you are probably mistaken.

There is nothing that you can do about it right now. While you could block KB3139929 on your system, you'd prevent security patches from being installed on it, and if you allow it, you have no option to remove the KB3146449 update individually which pushes the ads to Internet Explorer 11.

 

Maybe someone will figure out a way to get around this, by blocking the ads or somehow installing the security updates without the added fixes.

 

Article source

[vibranium]

Microsoft's tactics stink like Gollum's dinner leftovers.

 

 

[straycat19]

And I was called a fool for turning off all updates.  Since last June I have not been hacked, whacked, smacked, ransomed, invaded, keystroked, infected, or anything else, including not being bothered with Microsofts Get Windows 10 crap. 

[Pete 12]

Seems only working solution to get rid of this cancer , is switching off MS-updates totally .

With a good anti-virus and firewall this must be possible , coz there are no real system-updates anymore, only the Win10-crap...............

[haxzion]

And all this effort for just 10% of their revenue? I think not. 

[Karlston]

2 hours ago, Pete 12 said:

Seems only working solution to get rid of this cancer , is switching off MS-updates totally .

 

Or install GWX Control Panel. The author is probably hard at work to stop the MS bastards' latest unethical bullsh*t.

 

50 minutes ago, haxzion said:

And all this effort for just 10% of their revenue? I think not.

 

Exactly!  Even a lousy $5/month subscription would make them heaps more. No one will convince me that no one in Microsoft has thought "x million devices times $y subscription per month/year/whatever equals LOTS of money for us".

[WALLONN7]

Windows patch KB 3139929: When a security update is not a security update

[Karlston]

And more I just posted... Admins beware: Domain-attached PCs are sprouting Get Windows 10 ads

 

Sigh...

[steven36]

6 hours ago, Pete 12 said:

Seems only working solution to get rid of this cancer , is switching off MS-updates totally .

With a good anti-virus and firewall this must be possible , coz there are no real system-updates anymore, only the Win10-crap...............

Seems the only way to get rid of the cancer is install windows 10 or switch to  another platform . But I never use IE no ways so I would never see this no ways maybe ill block IE11 with my FW  now its going be like EDGE  and become adware .

 

Next news will be how millions got infected by not patching ..You may as well had stayed on XP  if you never plain to do Windows updates.

 

There we go problem solved 

IE is nothing  but another security vulnerability I dont need anyways . Now i block everything Microsoft calls out but windows updates witch is turned off.

 

 

[Conley Powell]

     I have stayed with XP. Doesn't look so foolish now, does it? In fact, it looks like a better idea with each passing day.

     I won't be surprised to hear that Microsoft has found a way to force 10 upon XP users.

[steven36]

55 minutes ago, Conley Powell said:

     I have stayed with XP. Doesn't look so foolish now, does it? In fact, it looks like a better idea with each passing day.

     I won't be surprised to hear that Microsoft has found a way to force 10 upon XP users.

Yes too me it does because I would use Linux all the time before i go back to 14 year old O/S that's not got any updates since 2014 . Or id even use windows 10 before i would XP.

 

On windows 8.1 this what done.

1. blocked IE with a firewall .

2 . Went  to Control Panel → Programs → Turn Windows Features on or off, Un-check the option Internet Explorer 11.

3 Uninstalled MS16-023: Security update for Internet Explorer: March 8, 2016.

4.rebooted

5. Ran windows update and hid Security update for Internet Explorer:

Now i dont even have IE or that update

[VileTouch]

 

[OrbingStorm]

What makes them so desperate to sink to this new low?

[Conley Powell]

     I'd be more than happy to use Linux were it not for the fact that software that is important to me isn't available for Linux. As for the fact that XP hasn't been updated since 2014...so what? The latest version of XP comes closer to giving me what I want than do later versions of Windows. There's no point in updating just for the sake of updating.

[CODYQX4]

This is a worrying trend.

 

Anyone who does anything to discourage applying security updates is helping malware devs and hackers.

 

That goes for potentially unwanted code in MS updates, and that goes for Oracle Java and their Ask Toolbar filth they peddle.

[steven36]

4 hours ago, CODYQX4 said:

This is a worrying trend.

 

Anyone who does anything to discourage applying security updates is helping malware devs and hackers.

 

That goes for potentially unwanted code in MS updates, and that goes for Oracle Java and their Ask Toolbar filth they peddle.

Microsoft has always helped malware devs they block good programs like irfanview and others  .But they let  most any devs package  adware and spyware in there programs longer than i been on the internet  witch is like 15 years i was one of the 1st ones to buy XP  when it was still a baby . Microsoft loved virus ridden Java so much they stole it for there O/S  and got sued and  had to  give it back to Sun . Now they there packing this Adware receptacle called windows 10  and putting adware in security updates for there virus ridden browser IE to try to push there Adware receptacle off to the masses .

 

Microsoft could of blocked off programs  with toolbars and other spywares years ago but they didn't  just like Browser vendors could had too . Now almost 2 decides latter browsers are starting   to block it but its messing  up there whole ecosystem because there own addons are installed in a way malware can be .so there haveing to make browsers less useable  in the process .And really what good is it just to install on some Adware receptacle  Microsoft makes that dont want you to use other browsers no how they only want you to use there virus ridden ones..

 

9 hours ago, Conley Powell said:

     I'd be more than happy to use Linux were it not for the fact that software that is important to me isn't available for Linux. As for the fact that XP hasn't been updated since 2014...so what? The latest version of XP comes closer to giving me what I want than do later versions of Windows. There's no point in updating just for the sake of updating.

You may be happy with it but the majority are not,  x86  and XP are on its way out the door  like it or not , you can buy a new machine  and run you're old legacy software in a XP  VM.

 

I can run you're outdated software just fine on Linux  if i set up a Windows XP VM  in it .

 

Linux  x86 and XP chrome  dropped  support for it  . And most new  browsers simply suck using XP  anyway  . Why  give up the ability  to use new software just to keep old software that can be ran in VM?  Im glad  i evolve with the times were im not depended  on outdated  software ..

[Conley Powell]

     I've used virtual machines quite a lot, and have always found them unsatisfactory. In any case, why should I use a virtual machine to run XP inside some other OS? What do other OS's give me that XP doesn't? Answer: not one thing that I want. The oft-repeated claims that this, that, or the other doesn't work well under XP are fantasy. Where are the numbers? I've tried the other systems, and they just plain don't deliver what the newer-is-always-better crowd say they do.

[steven36]

34 minutes ago, Conley Powell said:

     I've used virtual machines quite a lot, and have always found them unsatisfactory. In any case, why should I use a virtual machine to run XP inside some other OS? What do other OS's give me that XP doesn't? Answer: not one thing that I want. The oft-repeated claims that this, that, or the other doesn't work well under XP are fantasy. Where are the numbers? I've tried the other systems, and they just plain don't deliver what the newer-is-always-best crowd say they do.

If you was to try to convert  video x264  on it you're  looking at hours and hours .. Also the last XP  in 2010 i bought it came with  2 gb of  ram anything  over 480p x264 didn't  play good on it. . Upgraded it to windows 7 x64 it was crap still. You can buy a pc for a couple of 100 bucks for normal  use with windows 8.1 x64  and it will  run circles  around any old hardwared x86 O/S  .Today  with x265 even more modern low end processors  have a hard time with  it no way in the world a old p4  could handle  it.

 

I got a XP  box here from like 2002  and i still never quite figured  out what to do with it,  never been able to find a Linux distro  that's runs good on it i guess ill just put it in the trash .    To me the best they ever done was make computers  x64 with a lot of cores  and 4 or more GB of ram .  When i mess around with old pcs it makes me glad there not all i got.

[Conley Powell]

     Let me be clear: I couldn't care less what OS anyone uses. But there are a lot of people who take my continuing to use XP as a personal affront, if not something that should be prohibited by law. They just make themselves look foolish by their unfounded claims against XP and for everything else. Steven36, for example, seems to think he's enlightening the ignorant by telling them that the performance of an old machine running XP is unimpressive. The performance of an old machine running any OS is unimpressive.What about a new machine running XP?

[steven36]

17 minutes ago, Conley Powell said:

     Let me be clear: I couldn't care less what OS anyone uses. But there are a lot of people who take my continuing to use XP as a personal affront, if not something that should be prohibited by law. They just make themselves look foolish by their unfounded claims against XP and for everything else. Steven36, for example, seems to think he's enlightening the ignorant by telling them that the performance of an old machine running XP is unimpressive. The performance of an old machine running any OS is unimpressive.What about a new machine running XP?

I didn't say XP  was for its time was bad it was not bad for the times . But Microsoft  is pulling  away from x86  and Google  already is . Why would someone  put a x86 O/S  on  a new PC  that's not supported  by its maker and 3rd party vendor is dropping support  for it more and more all the time.? Its Microsoft's  fault  they killed it  . whats dead and still alive is a zombie . That's why ITs  call it the zombie  o/s.

Most people dont put O/S on machines that's why Linux never done that great you have to install it . The reason Windows 7 done good was it was at a time when people were buying new pcs  . You cant hardly get anyone to install windows 10 witch is free and the newest they got so no one is going install XP on a new PC  unless  they have a lot of money and build for a hobby.

[Conley Powell]

     Of course no one should expect manufacturers to put XP on new computers. I wiped the disks on my computers and installed XP myself.

     By the way, it is possible to buy a new computer with Linux installed.

[steven36]

1 minute ago, Conley Powell said:

     Of course no one should expect manufacturers to put XP on new computers. I wiped the disks on my computers and installed XP myself.

     By the way, it is possible to buy a new computer with Linux installed.

I know its possible  if you special  order them off the internet. But  there not in stores . I got a friend  that will build you a custom pc with anything you want on it  Game or Normal use . if you're willing to pay money talks bs walks