[X]My Assistant

[alancossey]

More information available at https://support.office.com/en-us/article/ac...83-f21636caedec

It says that the update for "Access for Office 365/Access 2016 C2R/Access 2019 (Version 1911)" will be available around 22nd November. On the Monthly update channel we are currently version 1910 so I am hoping it means that we will get that corrected version of 1911 (12228.20152) that day. The page is not totally clear to me.

[mike60smart]

Hi David

That worked for me

Many thanks

[FrankRuperto]

Uninstalling the security update may temporarily fix the problem, but I get the feeling MS wants us to mod all the update statements since "An information disclosure vulnerability exists which fails to properly handle objects in memory"

According to this CVE-2019-1402 advisory , MS' exploitability assessment states that the vulnerability is not publicly disclosed and no exploits have ocurred, but I feel the cat's out of the bag and hackers could exploit it now that they know everyone is rolling back the update.

[isladogs]

True but do we know whether the fix includes the security part of the original update?

[DanielPineault]

It says that the update for "Access for Office 365/Access 2016 C2R/Access 2019 (Version 1911)" will be available around 22nd November. On the Monthly update channel we are currently version 1910 so I am hoping it means that we will get that corrected version of 1911 (12228.20152) that day. The page is not totally clear to me.

MS has pushed out a fix for O365 C2R Monthly Channel in build 12130.20390 which is still 1910 according to Update history for Office 365 ProPlus (listed by date). So anyone running O365 C2R Monthly Channel need only perform a manual update (File -> Account -> Update Options -> Update Now) and the problem should go away.

[FrankRuperto]

At this point in time we don't know what MS plans on including in the fix, but my common sense tells me that they will try to resolve the handling of objects in memory so that the affected update statements wont need to be modified. However, in the MS Update Catalog it says "A security vulnerability exists in Microsoft Office 2013 32-Bit Edition that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability.", which sounds to me like MS' default generic description they use most of the times so I who knows what the real problem is. One things for sure, I bet many Access apps will remain broken if MS decides to continue enforcing the new security rule because either the users only have an accde and the developers are no longer available, or it will take forever to mod update statements in apps with tons of objects and code lines, and let alone, the tons of frontends that require the mod. In the meantime, those who rolled back the update in order to run their apps without having to mod the code are vulnerable. Those lucky enough to not have to mod the code in too many places will continue to run their apps whether the update is installed or not, unless MS' fix breaks something else.

[Wedge]

That's a start but the others (especially the 365 one) is needed urgently. Why on earth MS cannot stop a rogue patch like this is anyone's guess - this is terrible MS. You are still pushing it out!

[youngb]

Hi Guys,

I just learned the hard way yesterday about this issue and done a fix by installing a runtime version of Access07 to fix the problem, a pragmatic approach, they were a business that needed to get up and running fairly quickly and it worked despite been Windows 10, now have to say in general I didn't get caught because some my clients are on 2007 runtime versions, (a few are still on 2003 and they were fine) , initially I though was only full version but looks like it is also with Runtime, it was only a few who had unintentionally got updated with Office 365 with Windows 10 update from Windows 7 but I have put all these on 2007 runtime to get it working.
I have to agree that this 'Update' would not help your confidence in Access Applications.

Regards
Briah

[Wedge]

MS has pushed out a fix for O365 C2R Monthly Channel in build 12130.20390 which is still 1910 according to Update history for Office 365 ProPlus (listed by date). So anyone running O365 C2R Monthly Channel need only perform a manual update (File -> Account -> Update Options -> Update Now) and the problem should go away.

I can confirm that this does indeed work.

[theDBguy]

Hi All,

For what it's worth, I created the attached small utility as my way of temporarily handling this issue. It's still preliminary, but I didn't want to wait too long for a permanent fix from MS before deciding to share it, so here it goes. I know it doesn't handle all potential scenarios like a database with a Make-Table query, but I'll try to add that functionality later.

Hope it helps someone. Please let me know if you find any problems using it.

Thank you!

Attached File(s)

 theDBguyQueryBugFixV1.4.zip ( 29.88K )Number of downloads: 2

 

[theDBguy]

I had some time to add the functionality I mentioned earlier. Please see attached updated version... Thanks!

Attached File(s)

 theDBguyQueryBugFixV1.5.zip ( 33.63K )Number of downloads: 4

 

[jleach]

All: I've edited the permissions on the news board to allow members to download from it. Some quirk in the backend specific to this board. Please try again and post back if there's continued issues.

Thanks

[theDBguy]

Oh, thanks, Jack. I just created this post in the Queries forum to get around the download problem reported by some users. Oh well...

[gemmathehusky]

Personally, I think the cure suggested by MS is as bad as the problem.

I think as well as the query issue, it also affects recordset operations (maybe depending on the query), so opening a table, and the rs.addnew etc also failed, I believe.
Changing an testing everything in complex databases is hardly feasible.

Anyway, I have advised clients to unwind the update as the simplest fix

With regard to colin/isladogs issue about the version to revert to, I suspect the version you needed depended on the update stream you were using.

https://docs.microsoft.com/en-us/officeupda...proplus-by-date

[theDBguy]

Hi Dave. Using the fix I suggested/recommend, I tested, last night, opening a recordset was not a problem. Now, I just tested adding a new record to the recordset is also not a problem. No errors.

[JeffK]

ADODB recordset Update calls are breaking for me as well, with the same “Query ‘’ is corrupt” message. Access 2019, only on PCs with the security update applied. However, it’s only in cases where CursorLocation is set to adUseClient. Remove that solves the problem. With the client-side cursor setting, no changes to the source fix the problem ( such as selectig from a query or subquery).

[theDBguy]

Hi. Do you know if you have a volume licensed version of 2019?

[JeffK]

Yes, my Access 2019 is the perpetual license, not O365.

[theDBguy]

Just curious because VL 2019 doesn't have a fix available yet.

[rsindle]

This is a slightly different spin on this problem.
I have Office Pro 2010 and 2013 installed on my dev laptop.
2010 did NOT exhibit this problem. 2013 did.
Weird thing is if I go to "Installed Updates" all of my 2010 Security updates etc show up.
NONE for 2013.
My Access 2013 is (according to Microsoft) the latest version (15.0.5189.1000) 32-bit.
I went ahead and ran the 2010 patch (ace2010-kb2986256-fullfile-x86-glb.exe) and that ran.
The 2013 patch (ace2013-kb2965317-fullfile-x86-glb.exe) gave me the message:
"There are no products affected by this package installed on this system"
So I am dead-in-the-water on 2013, but 2010 runs fine.
****** UPDATE ON THIS ******
Apparently I DO have C2R for my 2013 (MSI for my 2010) as this link says:
Determine MSI or C2R

So will be waiting impatiently, for the 12/10/2019 fix for MY system.
UGH!

Rob