Posts Tagged


This month’s Windows and Office security patches: Bugs and solutions

How many bugs could a WinPatcher patch, if a WinPatcher could patch bugs?

Ends up that June’s one of the buggiest patching months in recent memory – lots of pesky little critters, and the ones acknowledged by Microsoft led to even more patches later in the month.

In June, we saw eight single-purpose Windows patches whose sole mission is to fix bugs introduced in earlier Windows patches. I call them silver bullets – all they do is fix earlier screw-ups. If you install security patches only, these eight have to be installed manually to fix the bugs introduced earlier. It’s a congenital defect in the patching regimen – bugs introduced by security patches get fixed by non-security “optional” patches, while waiting for the next month’s cumulative updates to roll around.

The Win10 Silver Bullets

Every modern version of Win10 except 1903 – which is to say, versions 1607, 1703, 1709, 1803, 1809, Server 2016 and Server 2019 – all got three cumulative updates this month. The third cumulative update for June resolves this one issue:

Devices may have issues connecting to some Storage Area Network (SAN) devices using Internet Small Computer System Interface (iSCSI) after installing KB4497934. You may also receive an error in the System log section of Event Viewer with Event ID 43 from iScsiPrt and a description of “Target failed to respond in time for a login request.”

In other words, it’s a silver bullet – an optional patch that fixes a bug introduced in an earlier patch that you’ll only get if you download and install it manually, or if you click on “Check for updates.”

What’s strange about this bevvy of patches is the timing. Apparently, the bug arrived with the third May cumulative updates on May 21. I first saw mention of it on a Dell support forum, on June 11 and posted about it on June 19. Microsoft hadn’t acknowledged the bug at the time. (The first official  announcement I saw was on June 26, the date all four silver bullets appeared.)

That’s more than a little disconcerting because Microsoft should be warning us about these problems quickly on the Release Information Status page.

The Win7 and 8.1 silver bullets

On June 20, Microsoft released silver bullet patches for Win7, 8.1, Server 2008 R2 SP1, 2012, 2012 R2, and Internet Explorer 11 to fix bugs introduced in the June 11 Monthly Rollups and Security-only patches.

The update for 7 SP1 and Server 2008 R2 SP1 KB 4508772, for Windows 8.1 and Server 2012 R2 KB 4508773 and for Server 2012:

“Addresses an issue that may display the error, ‘MMC has detected an error in a snap-in and will unload it.’ when you try to expand, view, or create Custom Views in Event Viewer. Additionally, the application may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs.”

Cumulative Update for Internet Explorer 11 KB 4508646

“Addresses an issue that causes Internet Explorer 11 to stop working when it opens or interacts with Scalable Vector Graphics (SVG) markers, including Power BI line charts with markers.”

The bug fixes are not included in the June Monthly Rollups or Security-only patches (June 11, 2019), but are included in the Preview Monthly Rollups released on June 20.

Once again, bugs introduced by security patches are getting the latest fixes in non-security patches.

More Win10 1903 bugs

The second monthly cumulative update for Win10 1903 appeared late, as usual, on June 27. KB 4501375 includes fixes for several acknowledged bugs, including the MMC error with Custom Views described in the preceding section.

Many people are complaining that this particular patch was downloaded without their consent – which is to say, without clicking “Check for updates.” @abbodi86 looked into it and discovered:

Based on my tests… KB4501375 (18362.207) behaves exactly the same way that Feature Updates behave on 1809 and 1803 – the “download and install now” behavior. In other words, KC 4501375 will be bundled and offered as [a] secondary update with any available update even if you don’t “Check for updates.” It’s possible that the latest .NET cumulative update will trigger this behavior.

That said, deferring Feature Updates (version updates) for just 1 day makes KB4501375 go away.

Win10 1903’s disappearing Update advanced Options

We’re still in a quandary about the behavior of Win10 1903’s update deferrals.

In Win10 1903 Pro, if you go into Windows Update, advanced options, you get a pane that looks like this.

1903 pro update advanced settings Microsoft

Windows 10 1903 Pro update advanced settings.

Several of you have noted that if you specify deferral options as I have here (non-zero numbers in either of the two bottom boxes), the entire “Choose when updates are installed” part of the advanced options dialog disappears.

@abbodi86 has undertaken some experiments with the settings. Here’s what he has concluded:

Yep, the Feature Update deferral box disappears once i change the entries to non-zero. Maybe it’s an intentional move so the user cannot change the period frequently? 🙂

Anyway, the Feature Update deferral period can be still controlled with registry setting

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsUpdateUXSettings] “DeferFeatureUpdatesPeriodInDays”=dword:0000016d

Group policy can be used to show you the feature update deferral period. The box will show up greyed, but at least you can know the period

@abbodi goes on to say that he tested changing the Quality Update deferral period the same way, with the same result — if you set it to anything other than zero, the whole section disappears. It may be related to an internal conflict with the way Semi-Annual Channel (Targeted) was removed.

Maybe, just maybe, this is the way it’s supposed to work. If so, I’d like to nominate this particular behavior for the “Harebrained Design” hall of fame. Giving a user an option, any option, then forcing them to dig into Group Policy to modify it, stinks.

On the radar

If you’ve been struggling with the “Intel” microcode updates for Meltdown/Spectre and other “Side Channel vulnerabilities,” you aren’t alone. The latest twist appears with Karl-WE’s enormous leg work, posted on GitHub, that brings some sense to the ongoing litany of patches.

In particular, Karl notes – and MS Security Response Center guru Jorge Lopez confirms – that the phrase in KB 4346085 that says:

Important Install this update for the listed processors only.

is, quite simply, wrong. Some of the updates apply to processors that are not listed. You’re better off trusting Windows Update to pick the ones that are right for your machine. Says Lopez:

“The team didn’t want to mislead anyone reading this KB in isolation to think that installing this KB/deploying across a fleet would mean they have met the requirement for microcode for these side-channel issues – that is only true for the processors listed on the KB. We will update the line, that’s not the right way to provide that warning. So yes, you don’t have to go through some complicated deployment matrix on this KB, but you still have to do so to determine what is protected or not (vuln scanning tools should help).  The logic to apply or not a microcode update is part of the boot sequence in the OS – if the processor has a microcode revision that is older than what the OS has, the OS will update the CPU microcode as part of the boot sequence.

Expect to see a correction to the KB article shortly.

To end on a positive note… remember the BlueKeep vulnerability? The one that had me crying that the sky is falling and you needed to install the May patches, like, right away? Kevin Beaumont (Twitter’s @GossiTheDog) has good news:

If anybody is pondering why there’s no public BlueKeep Remote Code Execution exploit, it’s a mix of difficulty [There’s a high bar for exploitation – in theory it is ‘just’ a use after free bug, but to be able to kernel spray you have to reverse engineer the RDP driver. There’s no documentation on how to do it for this.] and a handful of people in the InfoSec world being very responsible.

Yes, you still need to make sure you have the fix installed. You should’ve done it in May. When the exploit hits it’ll be painful. But at least we’ve been spared a bloodbath of unprecedented proportions.

Join us for more thrilling Tales from the Crypt on the AskWoody Lounge.

Source link

This month’s Windows and Office security patches: Bugs and solutions

In a normal month, you need a scorecard to keep track of Windows patches. Now, your scorecards need a scorecard. One ray of hope: It looks like some Windows 10 cumulative updates will include the new “Download and install now” feature.

The May 2019 Windows updates have taken so many twists and turns it’s hard to pin things down, but as of Thursday morning, here’s what we’ve seen.

Windows 10 cumulative updates

As of now, all of the recent versions of Win10 (1607/Server 2016, 1703, 1709, 1803, 1809/Server 2019) have had three cumulative updates in May. Depending on where you live (or, more correctly, which locality you’ve chosen for your machine), you’ve been pushed one or two of them. If you’re a “seeker” (and clicked “Check for updates” or downloaded and installed the patches), you’ve had at least two, and maybe three. Got that?

The reason for all the hilarity: The original Win10 cumulative updates broke access to certain sites that end with “” for Internet Explorer and Edge users. All 10 of you.

The latest “optional” (meaning for “seekers” only) non-security patches include the usual laundry list of fixes for an unconscionable number of bugs. Win10 1809, which has had an inordinate amount of work lavished on its bug fixes over the past eight months, still has several acknowledged flaws including this one:

When attempting to print from Microsoft Edge or other Universal Windows Platform (UWP) applications, you may receive the error, “Your printer has experienced an unexpected configuration problem. 0x80070007e.”

The special case of Win10 version 1903

Microsoft officially started pushing Win10 version 1903 on May 21 (see Gregg Keizer’s birth announcement), although I haven’t heard from anyone yet who’s had 1903 pushed onto their systems. Lots of people upgraded to 1903 by clicking on “Check for updates,” and many were already on 1903 when it went legit, by virtue of being in the Windows Insider Release Preview or Slow rings.

For good measure, Microsoft put its first “real” Win10 1903 cumulative update, KB 4497935, through the Release Preview wringer – a practice formerly reserved for Win10 1809 patches, which were notoriously late and arguably better vetted. All sorts of confusion resulted when KB 4497935, the May 29 cumulative update for 1903, was released to the teeming masses. (I heard lots of complaints about update deferral settings not being honored.)

As it happens, the settings for those still in the Insider program are different from the settings for those who received their copies of 1903 without being beta testers. Günter Born has a detailed explanation of what he’s seen in various permutations and combinations.

The single most important fix to Win10 this month arrived on Wednesday with the Win10 1903 KB 4497935 update:

Addresses an issue that may cause an external USB device or SD memory card to be reassigned to an incorrect drive during installation.

Win10 1903, as shipped, had a bug in it that swapped drive letters willy-nilly on external USB drives, SD memory cards, and even some internal drives. Susan Bradley put it this way:

My Lenovo laptop is “throttled” because I have an external usb drive that I am using to upgrade this device. This doesn’t bode well for my Acer that only has 32 gigs that I HAVE to attach an external hard drive in order to upgrade it.

So it now appears as if this cumulative update will fix Win10 1903. But in classic Catch-22 fashion, you can’t install the cumulative update on a machine that needs a USB drive in order to install the update.

In more Win10 1903 news, Trend Micro now says it won’t have a fix for Win10 1903 compatibility problems with its Apex One/OfficeScan XG SP1 products until early June. Microsoft’s release information page doesn’t mention the gaffe, although it does acknowledge the Sandbox fail to start with error code “0x80070002” bug, Dolby Atmos bugs, AMD RAID driver incompatibilities, display brightness issues, and a dozen additional bugs that should keep you from installing 1903 until Microsoft gets its act together.

See what I mean about scorecards?

Hope that the “Download and install now” option will work with cumulative updates

Microsoft has been talking about – and showing off – a new feature called “Download and install now” that will give everyone some control over when Win10 updates get installed. It’s a tremendous new feature – arguably the most important new feature in Windows 10 since the very first version shipped almost four years ago.

The official explanation of the feature states without reservation that the “Download and install now” option will be available for version changes: Before your machine is upgraded to a new version of Win10, you have to explicitly ask for it. Great. The explanation doesn’tspecifically say that the same “Download and install now” option will be available for cumulative updates.

Earlier this month, I wrote about the implications: “Download and install now” for version changes is tremendous. “Download and install now” for cumulative updates would be a game-changer, at least for those of us concerned about bad patches.

Now comes word from Leopeva64 – who’s been right about several Windows Update revelations – that Microsoft may implement “Download and install now” for (many? most? all?) of the monthly second (or third or fourth) “optional non-security” patches.

Time will tell, but we may be witnessing a real breakthrough.

‘Wormable’ BlueKeep still on the horizon

Earlier this month we had quite a shock when Microsoft announced, with appropriate fanfare, that every Windows XP, Win7, Server 2003, 2008 and 2008 R2 machine needed an inoculation to protect against a very mean “wormable” hole in Windows Remote Desktop Services. Billed as the son of WannaCry, Microsoft had everyone – including me – sounding the alarm to get the crazy thing patched. 

Now, two weeks later, BlueKeep (as Kevin Beaumont has named the hole) is still a threat, but it’s nowhere to be seen. Ends up that creating a real, working, destructive worm using the security hole is a highly non-trivial task.

I’ve asked every expert I can find about an obvious solution — isn’t it sufficient to simply turn off the Remote Desktop Protocol in the user interface? (In Win7, Start > Control Panel > System and Security > System > Remote Settings, in the System Properties dialog box, click Don’t Allow Connections to This Computer.) That, and/or blocking port 3389 (the port RDP uses by default) should be enough to keep any RDP-related malware at bay. At least, it appears that way to me.

But I haven’t received a positive response from any of those experts. The ones who know ain’t sayin’. And the ones who probably do know aren’t willing to stick their necks out. It’s hard to fault them: Microsoft hasn’t provided any guidance on the matter, one way or another, so if blocking RDP ends up being insufficient — no matter how logical — there’s a lot of exposure to the person making the recommendation.

Oh. For the dozens of you who still use Vista, Microsoft initially forgot to mention that the Server 2008 SP2 version of the patch also works with Windows Vista.

Peruse the Patching Pilgrim’s Progress on the AskWoody Lounge

Source link

This month’s Windows and Office security patches: Bugs and solutions

You have to wonder who’s testing this stuff.

Admins, in particular, have had a tough month. April brought widespread breakdowns – bluescreens, hangs, very sluggish behavior – to hundreds of thousands of Win7 and 8.1 machines. This wasn’t a “small percentage” kind of event. For some companies, rebooting overnight on Tuesday brought seas of blue screens on Wednesday morning.

The first round of cumulative updates and Monthly Rollups arrived on Patch Tuesday, but the now-ubiquitous second round didn’t show up until late Thursday afternoon, two and a half weeks later. Talk about admins taking a beating.

We still have one Tuesday left this month – the mythical “E week” that Microsoft never talks about – so the month may yet end with both a bang and whimper.

Here’s how things look as early Monday morning.

Still no ‘optional non-security’ cumulative update for 1809

It took a while, but the second round of April patches finally arrived. The one exception is for Windows 10 version 1809, which still hasn’t seen an “optional non-security” patch. (They’re “optional” because you have to be a seeker – click Check for updates – in order to get hit with the patch.)

We have a reliable report that the second patches this month were held up because of continuing problems with the Japanese new era date bugs. That same report also says that even the latest patches have bugs. I find it all amazing – Microsoft’s been working on this problem for at least a year, and the patches-of-patches have been stumbling all over themselves.

Even Win10 1903 – the version still in beta testing – got a new patch, KB 4497093, bringing the build number up to 18362.86. It’s for “Insiders who are currently in the Fast ring only and on Build 18362.53. We’ll roll this out to the Slow and Release Preview rings in a bit.”

Six dirty patches, five blasted antivirus companies

April’s Patch Tuesday brought immediate complaints of Win7 bluescreens. Within a couple of days we found out that six patches – for Win 7, 8.1, Server 2008 R2, 2012 and 2012 R2 – had conflicts with five different companies’ antivirus products. The current tally:

Sophos – The company now says it’s figured out the source of the problem:

“We have identified a permanent fix and are now automatically rolling out the fix to customers starting 25th April 2019. This will take place over a two- to three-week period.”

Microsoft continues to block the six dirty patches on systems running Sophos Endpoint.

Avira – The folks at Avira have been remarkably quiet. Our latest report from UAz says they may have finally hit upon a solution – verified in the very early hours of Monday morning. Earlier attempts at an Avira solution failed, sometimes spectacularly. Microsoft has not changed its terse announcement:

“Microsoft has temporarily blocked devices from receiving this update if Avira antivirus software is installed. We are presently investigating this issue with Avira and will provide an update when available.”

Arcabit – The small Polish-language AV supplier has released an update that solves the problem, according to Microsoft, although the Microsoft link to Arcabit’s support article points to a Technical Assistance phone number, and no discussion.

Avast/AVG – The company has issued hotfixes to avoid the bluescreens. (Avast owns AVG.) Oddly, though, the way to install the hotfixes isn’t what you might expect:

  1. Boot your machine
  2. Let the machine stand for approximately 15 minutes while emergency updater works. The updater runs on system context rather than the user, so you do not need to log in for it to activate.
  3. Reboot your machine. Your machine should now operate normally, even with the Microsoft updates listed above.

That, to me at least, is a very distressing way to apply a hotfix.

Microsoft no longer blocks the six dirty patches on machines running Avast or AVG.

McAfee – Late to the game, McAfee has acknowledged that installing the dirty six patches may lead to slow boot up times or slow performance. The only solution to the problem, at present – aside from uninstalling the dirty six – is to disable any user-defined (non-default) Access Protection rules.

Microsoft says it is “presently investigating this issue with McAfee,” but they’ve been saying that for a week.

A few more patch problems

I’m seeing scattered reports that Win7 users are being offered KB 3185319 — an update from Sept. 13, 2016 — as a checked Important update to Win7. It’s part of the MS16-104 bundle. I wrote about bugs in this patch back in October 2016. This isn’t the first time we’ve seen KB 3185319 appear out of the blue.

There are also reports of locked Server 2008 machines after installing this month’s Monthly Rollup, KB 4493471.

Keep up with the latest on the AskWoody Lounge.

Source link

Facebook Privacy: Password Leaks, Bugs, Dodgy VPNs, and Propaganda


Join Christian Cawley and James Frew as they take a look at some of the major privacy issues that have occurred around Facebook in the past six months. Issues such as storing passwords in plain text, exposing your photos, and demanding email passwords from new users have blighted users’ experiences.

Is time to move away from the world-famous social network?

Really Useful Podcast Season 2 Episode 12 Shownotes

As promised in this week’s show, here are the links to the recent Facebook privacy issues we discussed:

This week’s Really Useful Podcast is hosted by Christian Cawley and James Frew, who you can chat with on Twitter:

Share our podcast with anyone you know who could benefit with having otherwise complicated technology matters clearly explained.

Enjoy the show? Subscribe to the Really Useful Podcast on:

Subscribing means you won’t miss next week’s tech podcast for technophobes, in which we take a look at Facebook’s recent privacy issues.

Read the full article: Facebook Privacy: Password Leaks, Bugs, Dodgy VPNs, and Propaganda

Source link

This month’s Windows and Office security patches: Bugs and solutions

March was an unusually light patching month – all of Office only had one security patch – and there don’t appear to be any immediate patching worries. Just as in the past few months, Microsoft’s holding off on its second cumulative update for Windows 10 1809, raising hopes that it’s taking Win10 quality more seriously.

Win10 1809 deployment proceeded at a positively lethargic rate, even though Microsoft declared the OS fit for business consumption last week, leading to all sorts of speculation about the next-next update, Win10 version 1903, ultimately overtaking its younger sibling.

Dell’s Encryption Console gets clobbered by March’s Patch Tuesday Win10, 8.1, 7 patches

Dell has confirmed that every Windows patch in March – every one of them — bowled over its Encryption Local Management Console. The only solution offered is to either roll back the March patch or upgrade to Dell Encryption 10.2.1.

Few individual users have the Encryption Console, but it’s not uncommon on corporate machines.

Win10 version 1809 second cumulative update still MIA

All of the Windows 10 versions had two cumulative updates in March, except for Win10 version 1809, the latest version of the last version of Windows. I take it as a hopeful sign that Microsoft’s spending more time to get the bugs ironed out before delivering the “optional non-security” Win10 patch. (It’s “optional” in the sense that you’ll only get it if you click on “Check for updates.”)

There are five irritating, acknowledged bugs in Win10 1809 that haven’t been fixed yet:

  • IE 11 authentication issues
  • Audio devices stop working unexpectedly
  • MSXML6 may freeze the system
  • Custom URI schemes may not work correctly
  • Windows Deployment Services PXE may not work

Other versions of Win10 have some of the same bugs, introduced by earlier patches.

Just what Windows 7 needs – another round of ‘Get Windows 10’ nags

We’re covering the demise of Windows 7 intently over on AskWoody. But there’s one thing you definitely don’t need – another nagging patch from Microsoft. KB 4493132, a Win7 patch that does nothing bug nag, is definitely worth skipping.

We have some late-breaking news from Michael Horowitz that Win7 now has a scheduled task called refreshgwxconfig-B that seems to be associated with the widely despised “Get Windows X” campaign. It’s not clear at this point where the unwanted task came from.

Win10 1809 now ready for prime time, with 1903 on its heels

Microsoft changes its Windows updating terminology capriciously and with absolutely no consideration for settings baked into earlier versions of Win10. But never mind. With word from on high that Win10 version 1809 has been deemed worthy of business deployment, we also have assurances that we’ll get similar confirmation for Win10 versions from 1903 onward. (And that makes me wonder whether we’ll have yet another change in terminology soon.)

In general, March’s patches seem quite tame. Let’s hope that’s the new normal.

Questions answered and discussions dissed on the AskWoody Lounge.

Source link