A Fixed MS14-066 Being Reoffered to Windows Server 2008 R2 and 2012

Remember MS14-066? You should. As it turned out, MS14-066 was the patch that kept Microsoft from having its first perfect Patch Tuesday release in years. And, what caused it? It appears Microsoft got cocky. Like Icarus, it thought it could fly close to the sun without getting burned.

Instead of just releasing an update that fixed a security vulnerability, Microsoft decided to throw in additional functionality changes. In the original bulletin, in the FAQ section, it states:

Does this update contain any additional security-related changes to functionality?

Yes. In addition to the changes that are listed in the Vulnerability Information section of this bulletin, this update includes changes to available TLS cipher suites for Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012 systems.

The additional functionality changes set off customer reports far and wide over problems, which you can read about here: MS14-066 is this Month's Problem Patch. In short, the TLS changes caused connectivity problems, compatibility glitches, and performance issues.

Of course, as with each monthly report of suspect updates, Microsoft says only a small number of customers were affected. And, that's probably true, when you consider the number of total customers Microsoft has, along with the number of customers that are now scared to patch right away, despite any communicated urgency. Still, it is what it is, I guess.

Today, Microsoft has updated the original Security Bulletin for MS14-066 with news that the update (2992611) will be reoffered to systems running Windows Server 2008 R2 and Windows Server 2012. Microsoft has altered (or fixed?) the update to hopefully resolve the TLS cipher suite problems.

Those running the aforementioned operating systems will want to reapply the update, even if it's already installed. For those that have held off from installing this month's updates due to being burned in the past months, this new one (crossing fingers) should be the only one you need.