It's Patch Blues-day for Outlook: Microsoft's email client breaks worldwide following software update
- Reference: 1594841131
- News link: https://www.theregister.co.uk/2020/07/15/outlook_patch_crashes/
- Source link:
Register readers reckon yesterday's July Patch Tuesday update for the desktop software is today causing the client to crash with 0xc0000005 errors when run. "Microsoft has borked Outlook. If you update it to the latest update, it doesn't work," one tipster told us. "Thousands of users worldwide are now experiencing this."
It appears Outlook 2019 and 2016 are affected, whether they are using a cloud-hosted Office 365 service, Outlook.com, or on-prem Exchange. Monitoring at [1]DownDetector shows that, indeed, America and Europe, at least, are experiencing failures right now, starting around 9am PT (1600 UTC).
Microsoft did not immediately respond to a request for comment, though the official Microsoft 365 cloud status Twitter feed acknowledged the breakdown, and pointed toward the July update as a possible cause for the borkage:
We're investigating whether a recently deployed update could be the source of this issue. As a workaround, users can utilize Outlook on the web or their mobile clients. Additional details can be found in the admin center under EX218604 and OL218603. — Microsoft 365 Status (@MSFT365Status) [2]July 15, 2020
As you can see, we're told the web and mobile Outlook clients are not affected, and that Redmond's engineers are on the case. On its Office 365 status page, Microsoft warned as we published this story that it may take another couple of hours to correct the blunder, for Outlook.com users at least:
Title: Users unable to access Outlook.com
User Impact: Affected users may be unable to access email or service features through Outlook.com
More info: Our analysis indicates that Outlook on the web and mobile clients are unaffected. Users may be able to leverage those protocols as an alternative means to access email and service features while we remediate this problem.
Current status: Our fix is rolling out as expected and we've confirmed that users are experiencing service restoration as the solution reaches their respective environments. We're actively monitoring this process to ensure that our fix reaches all customers as soon as possible.
Scope of impact: This issue may potentially affect any of your users attempting to use Outlook.
Estimated time to resolve: We expect this issue to be completely resolved for all affected users by July 15, 2020 at 9:30 PM UTC.
Folks who want to avoid the crashes are [3]unofficially advised to roll back their Outlook installations to a known-working June 24 version, and this can be done via the Windows command line: cd “\Program Files\Common Files\microsoft shared\ClickToRun”
officec2rclient.exe /update user updatetoversion=16.0.12827.20470
Unfortunately for users and admins, yesterday's [4]Patch Tuesday update from Microsoft was a pretty significant one, delivering 123 bug fixes. For Outlook in particular, the patches cleaned up CVE-2020-1349, a remote-code-execution flaw involving memory corruption. The bug was particularly nasty, as an exploit does not require much in the way of user interaction.
"What sets this vulnerability apart is the fact that just viewing the email in the Preview Pane is enough to trigger the bug," said Dustin Childs of the Trend Micro Zero Day Initiative.
So, at the moment, if it is the July security update causing the crashes, and if the roll-back undoes the CVE-2020-1349 patch, users and admins must decide between using an insecure email client, or no email client at all until Microsoft fixes the glitch. For what it's worth, we've yet to see any in-the-wild exploits for the bug. ®
Get our [5]Tech Resources
[1] https://downdetector.com/status/outlook/
[2] https://twitter.com/MSFT365Status/status/1283450504865964032?ref_src=twsrc%5Etfw
[3] https://www.reddit.com/r/sysadmin/comments/hrq0mn/outlook_immediately_crashing_on_open_after/fy5nnx2/
[4] https://www.theregister.com/2020/07/15/july_2020_patch_tuesday/
[5] https://whitepapers.theregister.com/
Other options
"users and admins must decide between using an insecure email client, or no email client at all until Microsoft fixes the glitch."
Or perhaps they can scream " ENOUGH! " and change to a real email system that doesn't provide headaches like this at mind bogglingly frequent intervals?
So much for QA testing.
If they didn't test it on more than 1 pc to check that it actually ran at all, how do they know the 123 fixes have actually worked?
If yhey did actualy manage to get it running on more than 1 pc why don't they publish a recommended configuration for users to try before rolling back. As the article says, a number of the fixes are security critical and you don't really want to open up your system to crackers by reverting to a version with known attack vectors.
Re: So much for QA testing.
I have just realised how ironic it would be if they only tested it on PCs running with WSL enabled 'cos you know that linux stuff is so flaky and if it runs on a PC setup like that, it will run on anything because Windows core is so reliable.
2021 and an email in the preview pane triggers a bug fgs.
Still in 2020 here. Also borked.
Office 320
And falling
I hope all the affected users immediately sent an angry email to Microsoft.
Digital distancing
Outlook 2019 worked in safe mode.
I'm guessing this only affects Windows versions?
Mac version updated yesterday and seems to be working ok.
Damned
I received an attempt to exploit the Outlook flaw last night, so damned if you roll back, damned if you don't.