Posts Tagged

nonsecurity

Microsoft to stop serving non-security monthly updates to Windows

Beginning in May, Microsoft plans to halt the delivery of all non-security updates to Windows, another step in its suspension of non-essential revisions to the OS and other important products.

The optional updates, which Microsoft designates as Windows’ C and D updates, are released during the third and fourth week of each month, respectively.

“We have been evaluating the public health situation, and we understand this is impacting our customers,” Microsoft said to some understatement in a March 24 post to the Windows 10 messaging center. “In response to these challenges we are prioritizing our focus on security updates.”

Security updates, labeled as B updates, are better known as those released on Patch Tuesday – Microsoft prefers Update Tuesday – or the second Tuesday of each month. The stoppage of C and D updates will not affect the company’s patching efforts. “There is no change to the monthly security updates; these will continue as planned to ensure business continuity and to keep our customers protected and productive,” the message read.

The C and D updates are used to test non-security fixes which are to be officially released the following month as part of the all-encompassing Patch Tuesday cumulative update. According to Microsoft, the C and D updates should not be distributed to all Windows client systems. Instead, the D update, which Microsoft ships two weeks after one Patch Tuesday and two weeks before the next, should be used to “…test the updates included in the release and provide feedback, reducing the amount of testing necessary following Update Tuesday and, thereby, improving our ability to solve issues before they even happen.”

Because they’re optional, some customers simply skip them.

The most recent D update was released Tuesday for Windows 10 1903 and Windows 10 1909._

Windows 10’s C updates are relatively rare. In the five months since Microsoft released Windows 10 1909, for example, the version has been served three D updates but zero C updates.

Wednesday’s May shuttering of C and D updates is the latest move by Microsoft to limit update efforts to security fixes or reduce IT overhead while the COVID-19 pandemic upends business, businesses in general and business processes. So far this month, Microsoft has extended support for Windows 10 1709 an additional six months for customers running Windows 10 Enterprise or Education, and curtailed feature upgrades for its Edge browser.

Microsoft gave no explanation as to why it’s waiting until May to suspend the non-security updates, rather than put the policy into immediate effect and thus block potential updates expected on April 21 (C) and/or April 28 (D).

Copyright © 2020 IDG Communications, Inc.



Source link

Disappearing SMBv3 patch, non-security Office patches, and a so-far-mild Patch Tuesday

It’s been almost 24 hours since this month’s Patch Tuesday patches rolled out. The good news: Almost everybody patching individual machines reports smooth sailing.

That’s remarkable, given the host of problems with last month’s disappearing icons (temporary profile) bug and the unending litany of complaints about the last “optional, non-security, C/D Week” patch. As best I can tell, none of those problems have been officially acknowledged, and if they’re still in evidence with yesterday’s patches, people aren’t complaining about them. Yet.

To be sure, we’re still seeing the usual problems with installing the patches — Error  0x800f0900 seems particularly prolific on Reddit — but at this early juncture, I don’t see any debilitating problems.

That may well change. Many patchers have other problems on their minds and the day is still young.

Duplicated updates

I’ve seen numerous reports of duplicated updates in Windows Update lists, specifically for Windows 8.1, a .Net Quality Rollup, and the Server 2012 R2 Monthly Rollup. Seeing the same, identical patch listed twice in an update list does not inspire confidence. 

It looks like Microsoft tidied up the list overnight. At this point there are 110 “2020-03” entries in the Microsoft Update Catalog — which is to say, 110 individual patches — three fewer than there were last night.

Less is better, yes?

Extra Office updates

It looks as if Microsoft took advantage of Patch Tuesday to release additional non-security patches for Office. Usually the non-security Office patches come out on the first Tuesday of the month, but this announcement contains links to all of these new Office non-security patches:

Excel 2016

March 10, 2020, update for Excel 2016 (KB4011130)

Office 2016

March 3, 2020, update for Office 2016 (KB4484247)

Office 2016

March 10, 2020, update for Office 2016 (KB3213653)

Outlook 2016

March 10, 2020, update for Outlook 2016 (KB4462111)

PowerPoint 2016

March 10, 2020, update for PowerPoint 2016 (KB3085405)

Project 2016

March 10, 2020, update for Project 2016 (KB3085454)

Skype for Business 2016

March 3, 2020, update for Skype for Business 2016 (KB4484245)

Skype for Business 2015 (Lync 2013)

March 3, 2020, update for Skype for Business 2015 (Lync 2013) (KB4484097)

Office 2016 Language Interface Pack

March 3, 2020, update for Office 2016 Language Interface Pack (KB4484136)

Remarkably, those patches are not listed in the official Latest non-security updates for versions of Office that use Windows Installer (MSI) post.

The strange case of CVE-2020-0796 ‘CoronaBlue’ 

Yet another patch timing mishap: The SMBv3 patch described in Microsoft Security Advisory ADV200005 | Microsoft Guidance for Disabling SMBv3 Compression has been causing all sorts of consternation among admins in charge of networks running SMBv3. 

Long story short, Microsoft apparently had the patch ready to go but pulled it at the last minute. Microsoft warned security software manufacturers in advance that the patch was coming (a common practice), but didn’t yell, “Stop the presses!” in time to keep the cows in the barn. Two organizations on the inside accidentally published, then pulled, descriptions. The story raced through the blogosphere.

The hole is wormable in that it might be able to propagate without any human interaction. “Might” being the operable term: A potential exploit faces formidable challenges.

At first, Microsoft didn’t officially announce the hole, and didn’t post a fix. Then, its hand having been forced, on Tuesday night, Microsoft posted the Security Advisory, which says:

Microsoft is aware of a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client.

At this point, it appears that only Server 2013 and 2019 are affected. Microsoft has a manual workaround. There aren’t any known exploits but Catalin Cimpanu at ZDNet just tweeted:

I have now seen/talked to 3 different people claiming they found the bug in less than 5 minutes. I won’t be surprised if exploits pop up online by the end of the day.

If you’re in charge of a network running SMBv3, you can catch up on the developments by reading Satnam Narang on Tenable, Sergiu Gatlan at BleepingComputer, Catalin Cimpanu at ZDNet and, in the past couple of hours, Dan Goodin at Ars Technica. There’s an active discussion on AskWoody. You should also follow @msftsecresponse on Twitter.

If you aren’t running a network with SMBv3, you can chill. There’s nothing in this month’s patches that need concern you right now.

We’re kickin’ butt and naming names on AskWoody.

Copyright © 2020 IDG Communications, Inc.





Source link

The ‘optional, non-security’ update for Win10 version 1909, KB 4532695, runs zero for two

Last week Microsoft released KB 4532695, a dual-purpose Win10 version 1903 and 1909 “optional, non-security, C/D Week” patch. Most of us expected a fix for the File Explorer Search bar bugs that have been described and dissected (but not officially acknowledged) for more than two months

I, personally, also held out hope that Microsoft would fix yet another bug in the Internet Explorer JScript engine that warranted a Security Advisory in January. Yes, I know that the “optional, non-security” patches aren’t supposed to fix security holes, but … hope springs eternal.

On the File Explorer Search bugs: Windows guru Rafael Rivera tweeted shortly after the patch hit:

Unfortunately, it’s still a crummy experience. For example, it takes two clicks at times to reset the caret position, stopping you dead in your tracks. Search box continues to be a façade that can’t be right-clicked until it’s activated (e.g. via left-click). Advanced Query Syntax keywords, operators, and filters are no longer highlighted in blue, either. And deleting items didn’t make it in. I doubt we’ll see that get serviced; we’ll likely have to wait for 20H1 release [Win10 version 2004] to get that [feature].

Mayank Parmar, on Windows Latest, says:

Microsoft has yet to acknowledge the new problems with Explorer and there don’t appear to be any workarounds. If you have installed Windows 10 November 2019 Update [version 1909], you have to accept the possibility of experiencing issues with File Explorer and Control Panel.

As best I can tell, Microsoft has never acknowledged the bugs, in spite of fixing them in a series of updates for the still-in-beta Win10 version 2004. They aren’t mentioned on the Release Information Status page.

On the JScript fix, I initially said that KB 4532695 changes the jscript.dll file that’s at the center of the numerous security holes, and hoped that it fixed this latest JScript bug. My hopes were dashed when Mitja Kolsek, of 0patch fame, tweeted:

We tested it and KB4532695 does NOT modify jscript.dll. It does modify mshtml.dll (which we micropatched) but not in a way that would prevent jscript.dll from getting loaded. So it’s really unlikely that this KB does anything for CVE-2020-0674.

Zero for two.

KB 4532695 has drawn lots (and lots!) of fire in the press for putting “Millions” of Win10 users at risk for blue screens. From what I’ve seen, it’s not considerably worse than most “optional, non-security” Win10 patches — but it’s undeniably having lots and lots of installation problems

Fortunately, you’ll only get the patch if you download and install it manually, or if you get suckered into clicking “Download and install now” on an Optional updates available notification.

We’re watching you, KB 4532695, on AskWoody.com.

Copyright © 2020 IDG Communications, Inc.





Source link

Microsoft releases emergency IE patches inside ‘optional, non-security’ cumulative updates

I’ve seen a lot of confusion about the security hole known as CVE-2019-1367 and what normal Windows customers should do about it. Part of the reason for the confusion is the way the fix was distributed – the patching files were released on Monday, Sept. 23, but only via manual download from the Microsoft Update Catalog.

On a Monday.

In the past few hours, Microsoft released a hodge-podge of patches that seem to tackle the problem. They’re “optional non-security” and “Monthly Rollup preview” patches, so you won’t get them unless you specifically go looking for them.

As a bit o’ lagniappe, if you use Windows Update to install the sky-is-falling IE patch, you’ll get a bunch of additional marginally-tested patches along for the ride.

Here are the most important Win10 patches that appear to contain the IE/CVE-2019-1367 fix:

  • Win10 1809 and Server 2019 KB 4516077 – build 17763.774.
  • Win10 1803 KB 4516045 – build 17134.1039.
  • Server 2016KB 4516061 – build 14393.3242.

I say “appear to contain” the fix because, as best I can tell, none of the documentation mentions CVE-2019-1367, the security hole that was fixed yesterday in an odd single-purpose cumulative update. These, too, are cumulative updates, but they’re specifically identified as “non-security updates.”

Which is disingenuous, at best. 

Those patches are only available if you click “Check for updates.” Microsoft would traditionally call them “optional, non-security” patches, but with the likely (if undocumented) presence of a separately identified out-of-band security patch, it’s hard to say what to call them. 

We don’t have a cumulative update for Win10 1903 just yet. We do, however, have a manually downloadable out-of-band patch for the IE problem in 1903, KB 4522016.

Over on the Windows 7/8.1 side of the fence, it appears as if the CVE-2019-1367 fix is part and parcel of the two Monthly Rollup Previews just released:

  • Win7 KB 4516048 – “Addresses an issue that may cause an error when opening or using the Toshiba Qosmio AV Center. You may also receive an error in the Event Log related to cryptnet.dll.”
  • Win8.1 KB 4516041 – Fixes the bug that prevented IE 11 from running on RT devices.

There’s no indication in the KB articles that either of these Previews fix the IE hole, but an independent check by AskWoody’s @EP shows that the Previews contain the latest IE file. That likely means the security hole has been plugged in the Previews.

At this point, I don’t see why the Windows blogosphere has tied itself in knots warning about the IE/CVE-2019-1367 security hole. Yes, Microsoft has said that it’s been exploited in the wild. No, we don’t have any more information. The folks who know aren’t talking. The most credible story I’ve seen involves a very targeted attack from the (reputedly) Korean group known as DarkHotel.

At any rate, for almost everybody, this appears to be yet another tempest in a teapot. My advice is to sit tight, don’t update anything, and stop using Internet Explorer.

Unless you’ve done something to make DarkHotel angry, of course.

Keep up with the latest on AskWoody.

Copyright © 2019 IDG Communications, Inc.



Source link

Microsoft releases 20 Office non-security patches — and doesn’t bother to document them

The first Tuesday of the month — “A” week in Microsoft’s infamous bafflegab — usually brings a healthy dose of non-security Office patches. This Tuesday was no exception. But there are two big differences. First, there’s no official list of the patches. Second, many of the patches appear to be re-releases of patches that originally appeared in March.

Here we go down the rabbit hole.

Every month we get a list of Office patches on the MSDN Developer blog, an entry from the Office Sustained Engineering group. This month, the link turns up a “404 — This page has been disabled.” Apparently Microsoft’s in the process of moving its blogs from one ill-defined location to another, but in this case they seem to have slipped.

As best I can tell, there’s no list of this month’s patches.

AskWoody’s PKCano, relying on data extracted by Patch Lady Susan Bradley, has pieced together a list of the updates with descriptions and links. If you can find a similar list on Microsoft’s site, I’d sure like to know about it.

As has always been the case, PKCano’s list covers the MSI “perpetual” versions of Office, not Click-to-Run.

Not to be outdone in the vanishing documentation competition, Microsoft’s Latest updates for versions of Office that use Windows Installer (MSI) hasn’t been updated. Nor has Fixes or workarounds for recent Office issues.

PKCano’s list includes a number of patches that were apparently released on March 19. For example, if you click the link to KB 4011666, which Microsoft calls the “April 2, 2019, update for Office 2016 (KB4011666)” and then click the download link for that patch, under Details you see the info in the screenshot.

kb 4011666 Woody Leonhard/IDG

Clearly, Microsoft thinks this patch was published on March 19. 

So we have an unlisted set of 20 patches, claimed to be published on April 2, most (if not all) of which are also claimed to be published on March 19.

Is this the point where the rabbit starts muttering, “Oh dear! Oh dear! I shall be too late!”?

Off with their heads! on the AskWoody Lounge.



Source link