Microsoft warns of Visual Basic, VBA and VBScript 'procedure call' errors after August patches

Credit to Author: Woody Leonhard| Date: Thu, 15 Aug 2019 05:28:00 -0700

August is going to be a perilous patching month.

We’re tracking down credible reports of the Server 2012 R2 Monthly rollup breaking RDP logins, a conflict between the Win10 1903 cumulative update and last month’s version of Outlook 365, confusion about Win7 patches being branded as “IA64 only,” dealing with the lack of telemetry (!) in the August Win7 Security Only patch, much mayhem trying to install SHA-2 signed patches (including the Win7 Monthly Rollup) on systems using Symantec Endpoint Protection, even more confusion over the difference between Symantec Endpoint Protection and Norton Security Suite, and lots of the usual installation failures and rollbacks.

I’m personally fuming about a lot of press-generated humbug about the need to install all the August patches right away, to protect against DejaBlue (also known as BlueKeep II, III, IV and V). The Chicken Littles are winning the clickbait wars. There is still no publicly available exploit for BlueKeep, fer heaven’s sake, and there’s no way the DejaBlues are an “immediate, viral” threat.

While all of that was swirling around, Microsoft quietly released an update to the “Known issues” section of every August Windows patch. It says:

After installing this update, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an “invalid procedure call error.”

That’s a stunning error for Microsoft’s ubiquitous (if ancient) programming language.

Even more impressive: I can’t find independent reports of the bug. The German-language deskmodder.de site mentions the “Known issues” listing, but has no details. I can’t figure out where the error came from, how widespread it might be, why it appears, or if it can be worked around, except by uninstalling the patch. 

“Invalid procedure call” errors in VB are a dime a dozen. What happened in this month’s Windows patches to trigger them? And why wasn’t the bug caught before it was released?

One last question. Aren’t you glad you delayed updating this month?

If you know, let us know on AskWoody.com

http://www.computerworld.com/category/security/index.rss