As many of you know, Microsoft set an ultimatum last month that all Windows 8 users had to upgrade to Windows 8.1 Update 1 by June 10th, 2014, effectively end of life-ing Windows 8 and 8.1 (i.e. no more security updates for anyone that isn’t already on 8.1 Update 1).
What many people don’t know is why Microsoft made the upgrade to 8.1 Update 1 mandatory. The reasoning is pretty straight-forward: the Heartbleed security bug that shocked the technology world last month left Windows 8 and Windows 8.1 users’ information unprotected (read our in-depth blog post on Heartbleed).
I know what you’re thinking: we’re tired of this stupid Heartbleed stuff already as we thought that we were done with it by now. Unfortunately, Windows 8.1 shipped with a native Juniper Networks VPN client that was affected by Heartbleed, so it needs to be patched to get rid of the nastiest buffer overrides we’ve seen in ages.
Sadly, the patch that Microsoft issued to address the Juniper Networks piece, called KB2919355, breaks 10% of the time when run, leaving 1 in 10 unable to run the mandatory update. Microsoft’s customer support forums started blowing up shortly after Update 1 was released in early April as folks were reporting that Update 1 failed to install.
Microsoft responded May 5th with a revised KB2919355 patch that fixed some of those that were affected by the previous version but not all of them. There are still quite a few people out there that simply can’t upgrade, and their time is running out.