Microsoft warns of Visual Basic, VBA and VBScript 'procedure call' errors after August patches

[Karlston]

Microsoft warns of Visual Basic, VBA and VBScript 'procedure call' errors after August patches

Sometime in the past few hours, Microsoft posted official warnings about an 'invalid procedure call error' associated with August patches for all versions of Windows, from Win7 onward, and encompassing all flavors of Visual Basic. Who’s testing this stuff?

Thinkstock/Microsoft

August is going to be a perilous patching month.

 

We’re tracking down credible reports of the Server 2012 R2 Monthly rollup breaking RDP logins, a conflict between the Win10 1903 cumulative update and last month’s version of Outlook 365, confusion about Win7 patches being branded as “IA64 only,” dealing with the lack of telemetry (!) in the August Win7 Security Only patch, much mayhem trying to install SHA-2 signed patches (including the Win7 Monthly Rollup) on systems using Symantec Endpoint Protection, even more confusion over the difference between Symantec Endpoint Protection and Norton Security Suite, and lots of the usual installation failures and rollbacks.

 

I’m personally fuming about a lot of press-generated humbug about the need to install all the August patches right away, to protect against DejaBlue (also known as BlueKeep II, III, IV and V). The Chicken Littles are winning the clickbait wars. There is still no publicly available exploit for BlueKeep, fer heaven's sake, and there's no way the DejaBlues are an “immediate, viral” threat.

 

While all of that was swirling around, Microsoft quietly released an update to the “Known issues” section of every August Windows patch. It says:

After installing this update, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an "invalid procedure call error."

That’s a stunning error for Microsoft’s ubiquitous (if ancient) programming language.

 

Even more impressive: I can’t find independent reports of the bug. The German-language deskmodder.de site mentions the “Known issues” listing, but has no details. I can't figure out where the error came from, how widespread it might be, why it appears, or if it can be worked around, except by uninstalling the patch. 

 

“Invalid procedure call” errors in VB are a dime a dozen. What happened in this month’s Windows patches to trigger them? And why wasn’t the bug caught before it was released?

 

One last question. Aren’t you glad you delayed updating this month?

 

If you know, let us know on AskWoody.com

 

 

 

Source: Microsoft warns of Visual Basic, VBA and VBScript 'procedure call' errors after August patches (Computerworld - Woody Leonhard)

[Karlston]

First updates released that fix the Windows VB bugs

Microsoft released updates for Windows 7, Windows 8.1, and Windows 10 version 1709, as well as Windows Server 2008, 2008 R2, 2012 and 2012 R2 that addresses the recently discovered Visual Basic bug.

 

The company released the monthly security updates for Windows and other company products on August 13, 2019. Then, two days later, Microsoft acknowledged that the updates released for client and server versions of Windows were causing issues with Visual Basic applications and scripts.

 

The company noted:

After installing this update, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an "invalid procedure call error."

Microsoft did not reveal additional information about the issue at the time but the issue occurred shortly after Microsoft started to disable VBScript by default on machines running "older" versions of Windows. VBScript was disabled on newer versions of Windows a month earlier.

 

 

Microsoft released the following cumulative updates on August 16, 2019 that address the Visual Basic issues in those operating systems:

• Windows 7 SP1 and Windows Server 2008 R2 SP1: KB4517297
• Windows 8.1 and Windows Server 2012 R2: KB4517298
• Windows 10 version 1709: KB4512494

The release notes state:

Addresses an issue in which the following may stop responding and you may receive the error, "Invalid procedure call”:

• Applications that were made using Visual Basic 6 (VB6).
• Macros that use Visual Basic for Applications (VBA).
• Scripts or apps that use Visual Basic Scripting Edition (VBScript).

The updates for Windows 7, Windows 8.1, Windows Server 2008 R2 and 2012 R2 are not available via Windows Updates; home users need to download them manually from the Microsoft Update Catalog. Organizations find them using Windows Server Update Services (WSUS).

 

Here are the links to the Microsoft Update Catalog website from where the updates may be downloaded manually:

• KB4517297 for Windows 7 and Windows Server 2008 R2
• KB4517298 for Windows 8.1 and Windows Server 2012 R2
• KB4512494 for Windows 10 version 1709

Tip: you can check the August listing on the Microsoft Update Catalog to monitor update releases. There you find the links to the updates for Windows Server 2008 and 2012.

 

It is unclear why updates for other supported Windows 10 versions were not released as well. The update for Windows 10 version 1709 addresses other issues. It fixes the long-standing Preboot Execution Environment startup issue among other things. (thank you EP)

Closing Words

If you are affected by VB issues you may want to consider upgrading the system to the new version right away to fix the issue. Everyone else may be better off skipping the update for now; it will be included in coming patches automatically.

 

 

 

Source: First updates released that fix the Windows VB bugs (gHacks - Martin Brinkmann)

 

[steven36]

They are some trying to exploit  it but did not succeed since it wormblie it's just a matter of time , Wantacry was patched months   before the outbreak. hardening windows always have caused regressions .But it good  they fixed at lest in older OS so far, it's never a good idea to blindly install Windows updates anymore because they never be tested in the wild ,Microsoft didn't make a statement about tell it was too late for many 3 days after they rolled out the patch so millions mostly likely broke  visual basic already , Most people never hold off on updating and then complain about it it doesn't help that Windows 10 was designed to be unattended updates at a consumer level at lest . Not everyone is having success installing the patch on servers ether

 

 

[Karlston]

More fixes for the VB/VBA/VBScript bugs in this month’s patches

On Friday evening, we got fixes for the VB “invalid procedure call” bugs in

• Win10 1709
• Win7
• Win8.1
• Server 2008
• Server 2008 R2
• Server 2012
• Server 2012 R2

On Saturday afternoon (US time), a few more appeared:

• Win10 1809
• Win10 1703
• Win10 1607
• Win10 1507
• Server 2016
• Server 2019

Like the others, these are one-off patches that have to be installed manually or via a “Check for updates” click of death.

 

We’re still waiting for fixes for Win10 1803 and 1903.

 

There’s a reason why we’re on MS-DEFCON 2. Don’t install ANY of this month’s patches. Stay tuned.

 

I still get a chuckle when people tell me that Win10 is the “last” version of Windows…

 

UPDATE: Günter Born says, “But I received user feedback, that the issue isn’t completely fixed.” Oh boy.

 

 

 

Source: More fixes for the VB/VBA/VBScript bugs in this month’s patches (AskWoody - Woody Leonhard)

[frankl1n]

Hello brothers, I have an issue, neither Aug security update will install on my windows7 64bit system! I tried KB 4517297 first – (Released 8/16 fixes VB6, VBA,VBScript. If you install this you do not need KB4512486) This update failed to install for me, the update gave no reasons or error code, just said failed to install, so I try to installed KB 4512486 instead. It too will not install. Any ideas why or solution would be greatly appreciated.

[Karlston]

Microsoft re-issues the Win7 VB/VBA/VBScript fixing patch KB 4517297

Bear with me here….

 

Microsoft screwed up all of the Windows patches this month, clobbering VisualBasic, VBA and VBScript. You know that.

 

It has slowly been releasing Silver Bullet patches — largely single-purpose patches — to fix the error of its ways.

 

But there have been problems with the Win7 patch, in particular, KB 4517297. People report that they can’t get it to install, or that it doesn’t fix the problem. Günter Born has details.

 

Yesterday, MS released a new version of KB 4517297. The title of the KB article, Update for Windows 7 SP1 and Windows Server 2008 R2 SP1: August 16, 2019, hasn’t changed. Nor has the content of the KB article, as best I can tell — except for a note at the bottom that the article was updated on August 21.

 

What’s different? Does it fix the reported problems with the original KB 4517297? Or is it just a metadata change, to fix installation problems?

 

UPDATE: Looks like a metadata change.

 

Confirming that all of the files inside the download are dated 8/15. That’s not definitive, but it’s highly indicative of metadata changes.

 

Thx @PhantomOfMobile, @etguenni, @SBSDiva

 

 

 

Source: Microsoft re-issues the Win7 VB/VBA/VBScript fixing patch KB 4517297 (AskWoody - Woody Leonhard)

 

( @frankl1n  - This later version of KB4517297 may work for you )

[frankl1n]

13 minutes ago, Karlston said:

( @frankl1n  - This later version of KB4517297 may work for you )

hey brother I will try. I was just at Askwoody but did not see the stuff you posted. I will let you know if it was successful or not

[frankl1n]

21 minutes ago, Karlston said:

What’s different? Does it fix the reported problems with the original KB 4517297?

sorry m8 for me that is :) this is the same hash for file I have tried to install. So no help for myself, but thanks brother for the effort!

 

after this debunkle and last months crap I may never update my windows 7 again, if I performed at the level that MS does I would be fired from my job. lol

[frankl1n]

21 hours ago, frankl1n said:

I have an issue, neither Aug security update will install on my windows7 64bit system! I tried KB 4517297 first – (Released 8/16 fixes VB6, VBA,VBScript. If you install this you do not need KB4512486) This update failed to install for me, the update gave no reasons or error code, just said failed to install, so I try to installed KB 4512486 instead. It too will not install.

 

20 hours ago, Karlston said:

@frankl1n  - This later version of KB4517297 may work for you

 

Hello brother I have found a solution for my issue. The solution is here:

https://www.askwoody.com/forums/topic/august-2019-security-patches-its-a-biiiiiiiiig-month/

Quote

A reminder for those still on Windows 7 and/or Server 2008: SHA-2 Code Signing has become mandatory. You will also need to download KB4474419 (the SHA-2 v.2 update dated 8/12) and the Servicing Stack KB4490628 if it has not been previously installed.

 After installing the above 2 updates I was able to go back and install the Aug 2019 update KB4517297 with out any problems.

 

I wanted to share this info in case others have the same issue, maybe will help others!

IMHO MS should have incorporated the SHA-2 and Servicing Stack updates into one of the previous security updates, thank God for Woody!!!!!!!!