Posts Tagged


Take your time, get it right for March Patch Tuesday

This is a big update to the Windows platform for the Microsoft March Patch Tuesday release cycle. Consisting of 115 patches, mostly to the Windows desktop, with almost all of the critical issues relating to browser-based scripting engine memory issues, this will be a difficult set of updates to release and manage.

The testing profile for the Windows desktop platform is very large, with a lower than usual exploitability/risk rating. For this month, we do not have any reports of publicly exploited or disclosed vulnerabilities (zero-days), so my recommendation is to take your time, test the changes to each platform, create a staged rollout plan and wait for future (potentially) imminent changes from Microsoft.

Known issues

Each month, Microsoft includes a list of known issues that relate to the operating system and platforms that are included in this update cycle. I have referenced a few key issues that relate to the latest builds from Microsoft including:

  • When using Windows Server containers with the March 10, 2020 updates, you might encounter issues with 32-bit applications and processes. For important guidance on updating Windows containers, please see Windows container version compatibility.
  • After installing KB4493509, devices with some Asian language packs installed may receive the error, “0x800f0982 – PSFX_E_MATCHING_COMPONENT_NOT_FOUND.”
  • CVE-2020-0903 | Microsoft Exchange Server Spoofing Vulnerability: When you try to manually install this security update by double-clicking the update file (.msp) to run it in Normal mode (that is, not as an administrator), some files are not correctly updated.
  • Internet Explorer: After installing this update and restarting your device, you might receive the error, “Failure to configure Windows updates. Reverting Changes. Do not turn off your computer” and the update might show as Failed in Update History. Please see KB4497181.

And on Windows 7.x, 8.x and Server 2012 builds you will still see the following (outstanding) known issues:

  • Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).” This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

Microsoft is working on a resolution and will provide an update in an upcoming release.

Major revisions

There have been numerous updates to the Microsoft LDAP Channel binding and signing advisory over the past year. Microsoft has recently posted a new update that includes:

“Microsoft is announcing that the March 10, 2020 security updates are available that add options for administrators to harden the configurations for LDAP channel binding on Active Directory domain controllers. Further information and configuration options can be found here: ADV190023. While the latest servicing stack information can be found here (ADV990001).”

The following Remote Desktop vulnerabilities have now been updated to include all versions of Windows 10:

No further action for all of these major revisions is required if you are using Microsoft automatic updates.

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

  • Browsers (Microsoft IE and Edge)
  • Microsoft Windows (both desktop and server)
  • Microsoft Office (Including Web Apps and Exchange)
  • Microsoft Development platforms (ASP.NET Core, .NET Core and Chakra Core)
  • Adobe Flash Player


It’s not you, it’s your browser. With 15 critical updates and one remaining patch rated as important by Microsoft, the majority of critical vulnerabilities addressed in this month’s Patch Tuesday relate to browser-based scripting Engines (Chakra, JavaScript). Though all of the critical rated patches could lead to remote code execution scenarios, their CVSS scores and thus their corresponding exploitability are quite low (average 4.4 out 10).

Further narrowing the security concerns for these reported vulnerabilities is that they only apply to relatively few Windows builds. If you are on the latest release of Windows 10, you are probably OK. If you are on an old version of Windows (pre-Chakra), you are not affected. If you are running a really early version of Windows 10 (who are you?), then you have a problem. Add these browser patches to your standard rollout schedule.

Microsoft Windows

With 73 updates (of which 6 are rated as critical), this month’s Windows update covers a lot of functionality across the Windows ecosystem, including changes to: Microsoft Scripting Engine, Windows App Platform and Frameworks, Windows Media, Windows Silicon Platform, Microsoft Edge, Internet Explorer, Windows Fundamentals, Windows Authentication, Windows Kernel, Windows Core Networking, Windows Storage and File Systems, Windows Peripherals, Windows Update Stack, and Windows Server.

Some areas of concern include LNK file handling changes (CVE-2020-0684), updates to the Microsoft graphics core engine (GDI) and a slew of patches to the Windows media engine (CVE-2020-0801, CVE-2020-0807, CVE-2020-0809, CVE-2020-0869).

Aside from the documented security issues, I feel that this month we are at risk of some patch deployment challenges. This month’s Patch Tuesday is a large update that covers a lot of “functional territory.” This means a lot of testing will be required across core Windows functionality and application dependencies.

Working through the patch manifest and update payloads, there are some core files that have been updated that have caused application issues in the past. One good example includes the file MSXML3R.DLL, which was updated in CVE-2020-0844. We have already encountered a number of potential issues in the following applications as part of our algorithmic analysis, including:

  • WinZip 18.5
  • VMWare Workstation Professional
  • NV/HPE Controller
  • Siebel Tools 8.1.x

Our advice this month is to take your time with this update, create a staged rollout (IT first) and then deploy in concentric rings of business priority.

We also expect some out-of-band updates later this month — possibly with an update to the LNK patches or the SMB issue. For further guidance on the potential issues with the latest SMB vulnerability, Microsoft has released an advisory here: ADV200005.

Editor’s note: Microsoft released KB4551762 on March 12 to address the SMBv3 vulnerability.

Microsoft Office

This month Microsoft Office has one critical patch in Word (CVE-2020-0852) with eight other vulnerabilities rated as important by Microsoft. The Word-related vulnerability addresses a memory issue and could lead to a remote code execution scenario; it is relatively difficult to exploit. Add these updates to your regular patch cadence office.

Microsoft Development Platforms

For March Microsoft has released five patches for its development platform, all rated as important by Microsoft. Mostly affecting the Azure DevOps server, they are (currently) difficult to exploit and lead only to spoofing and elevation of privilege attacks. Add these minor updates to your standard development update effort.

Adobe Flash Player

Adobe has chosen not to release any updates for this March Patch Tuesday cycle. Unfortunately, this does not mean that there are no vulnerabilities to exploit this month. Expect an update from Adobe next week or shortly after. Until then, it’s Margarita time!

Copyright © 2020 IDG Communications, Inc.

Source link

Disappearing SMBv3 patch, non-security Office patches, and a so-far-mild Patch Tuesday

It’s been almost 24 hours since this month’s Patch Tuesday patches rolled out. The good news: Almost everybody patching individual machines reports smooth sailing.

That’s remarkable, given the host of problems with last month’s disappearing icons (temporary profile) bug and the unending litany of complaints about the last “optional, non-security, C/D Week” patch. As best I can tell, none of those problems have been officially acknowledged, and if they’re still in evidence with yesterday’s patches, people aren’t complaining about them. Yet.

To be sure, we’re still seeing the usual problems with installing the patches — Error  0x800f0900 seems particularly prolific on Reddit — but at this early juncture, I don’t see any debilitating problems.

That may well change. Many patchers have other problems on their minds and the day is still young.

Duplicated updates

I’ve seen numerous reports of duplicated updates in Windows Update lists, specifically for Windows 8.1, a .Net Quality Rollup, and the Server 2012 R2 Monthly Rollup. Seeing the same, identical patch listed twice in an update list does not inspire confidence. 

It looks like Microsoft tidied up the list overnight. At this point there are 110 “2020-03” entries in the Microsoft Update Catalog — which is to say, 110 individual patches — three fewer than there were last night.

Less is better, yes?

Extra Office updates

It looks as if Microsoft took advantage of Patch Tuesday to release additional non-security patches for Office. Usually the non-security Office patches come out on the first Tuesday of the month, but this announcement contains links to all of these new Office non-security patches:

Excel 2016

March 10, 2020, update for Excel 2016 (KB4011130)

Office 2016

March 3, 2020, update for Office 2016 (KB4484247)

Office 2016

March 10, 2020, update for Office 2016 (KB3213653)

Outlook 2016

March 10, 2020, update for Outlook 2016 (KB4462111)

PowerPoint 2016

March 10, 2020, update for PowerPoint 2016 (KB3085405)

Project 2016

March 10, 2020, update for Project 2016 (KB3085454)

Skype for Business 2016

March 3, 2020, update for Skype for Business 2016 (KB4484245)

Skype for Business 2015 (Lync 2013)

March 3, 2020, update for Skype for Business 2015 (Lync 2013) (KB4484097)

Office 2016 Language Interface Pack

March 3, 2020, update for Office 2016 Language Interface Pack (KB4484136)

Remarkably, those patches are not listed in the official Latest non-security updates for versions of Office that use Windows Installer (MSI) post.

The strange case of CVE-2020-0796 ‘CoronaBlue’ 

Yet another patch timing mishap: The SMBv3 patch described in Microsoft Security Advisory ADV200005 | Microsoft Guidance for Disabling SMBv3 Compression has been causing all sorts of consternation among admins in charge of networks running SMBv3. 

Long story short, Microsoft apparently had the patch ready to go but pulled it at the last minute. Microsoft warned security software manufacturers in advance that the patch was coming (a common practice), but didn’t yell, “Stop the presses!” in time to keep the cows in the barn. Two organizations on the inside accidentally published, then pulled, descriptions. The story raced through the blogosphere.

The hole is wormable in that it might be able to propagate without any human interaction. “Might” being the operable term: A potential exploit faces formidable challenges.

At first, Microsoft didn’t officially announce the hole, and didn’t post a fix. Then, its hand having been forced, on Tuesday night, Microsoft posted the Security Advisory, which says:

Microsoft is aware of a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client.

At this point, it appears that only Server 2013 and 2019 are affected. Microsoft has a manual workaround. There aren’t any known exploits but Catalin Cimpanu at ZDNet just tweeted:

I have now seen/talked to 3 different people claiming they found the bug in less than 5 minutes. I won’t be surprised if exploits pop up online by the end of the day.

If you’re in charge of a network running SMBv3, you can catch up on the developments by reading Satnam Narang on Tenable, Sergiu Gatlan at BleepingComputer, Catalin Cimpanu at ZDNet and, in the past couple of hours, Dan Goodin at Ars Technica. There’s an active discussion on AskWoody. You should also follow @msftsecresponse on Twitter.

If you aren’t running a network with SMBv3, you can chill. There’s nothing in this month’s patches that need concern you right now.

We’re kickin’ butt and naming names on AskWoody.

Copyright © 2020 IDG Communications, Inc.

Source link

Patch Tuesday’s tomorrow. We’re in uncharted territory. Get Automatic Updates paused.

It’s always a good idea to pause Windows updates just before they hit the rollout chute. This month, we’re facing two extraordinary issues that you need to take into account. Wouldn’t hurt if you told your friends and family, too.

Take last month’s Windows patches. Please. We had one patch, KB 4524244, that slid out on Patch Tuesday, clobbered an unknown number of machines (HP PCs with Ryzen processors got hit hard), then remained in “automatic download” status until it was finally pulled on Friday. We had another patch, KB 4532693, that gobbled desktop icons and moved files while performing a nifty trick with temporary user profiles. Microsoft never did fix that one.

Those aren’t isolated incidents. We see the same pattern, over and over again. Microsoft releases patches that aren’t adequately tested. Screams of pain ensue. Microsoft fixes some of the patches, doesn’t fix others. Wash. Rinse. Repeat. 

Getting out of the automatic update-induced karmic crapwheel is a mighty pain — and one that’s entirely avoidable. Just avoid the automatic updating, wait and see while crowdsourced beta-testing runs its course.

As if you needed more incentive, this month two additional problems loom.

First, the “optional, non-security, C/D Week” patch that rolled two weeks ago, KB 4535996, has had all sorts of problems. Mayank Parmar at Windows Latest and Lawrence Abrams at BleepingComputer document an impressive list of freezes, crashes, broken drivers, lousy performance, and black and blue screens. Microsoft hasn’t officially acknowledged any of the bugs.

The only bug that has been acknowledged, one that breaks the signtool.exe app in Visual Studio used to sign projects, drew a reference in one blog post from one Microsoft engineer. “We are working on a resolution and estimate a solution will be available in mid-March.”

In normal times, we’d expect the bugs in the “optional” patch to get ironed out by the time the regular cumulative update appears. The past couple of weeks, though, have been anything but normal times.

Almost all of Microsoft’s staff in the Northwest has been working from home for the past week. Microsoft announced late last week that two of its employees in the Seattle area have tested positive for COVID-19, the new coronavirus. You would think that the transition to telecommuting would be easy — after all, Microsoft’s been selling telecommuting-friendly software for decades — but word from the trenches is that there are plenty of bumps in the road.

That brings me to my second concern about this month’s patches. Even if Microsoft gets its act together and fixes the known (and unknown!) bugs in this month’s Patch Tuesday patch, we have exactly zero experience with Microsoft handling new bugs in this coronavirus-influenced work-from-home environment. 

Microsoft has a hard enough time fixing bugs when the whole crew’s in one building, in shouting distance. Heaven only knows what’s going to happen this month.

You have to patch sooner or later. But there’s even more reason this month to not be in the “sooner” cohort.

Blocking automatic update on Win7 and 8.1

Those who paid for Win7 Extended Security Updates should be plenty cautious about installing patches immediately. Those who didn’t will either ignore the patches (large majority there), or wait to see if free alternatives appear. We’ll be covering both intently on

If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Blocking automatic update on Windows 10

By now, almost all of you are on Win10 version 1903 or 1909. Not sure which version of Win10 you’re running? Down in the Search box, near the Start button, type About, then click About your PC. The version number appears on the right under Windows specifications.

If you’re using Win10 1803 or 1809, I strongly urge you to move on to Win10 version 1909. If you insist on sticking with Win10 1809 (hard to blame ya!), you can block updates by following the steps in December’s Patch Tuesday warning. Be acutely aware of the fact that Microsoft won’t be handing out any more security patches for 1809 Home or Pro after the May Patch Tuesday. Two months to go.

In version 1903 or 1909 (either Home, Pro, Education or Enterprise, unless you’re attached up an update server), using an administrator account, click Start > Settings > Update & Security. If your Updates paused timer is set before March 30 (see screenshot), I urge you to click Resume Updates and let the automatic updater kick in — and do it now, before noon in Redmond on Tuesday, when the Patch Tuesday patches get released.

1909 pause updates to 3 30 2020 Woody Leonhard/IDG

If Pause is set to expire before the end of March, or if you don’t have a Pause in effect, you should set up a patching defense perimeter that keep patches off your machine for the rest of this month. Using that administrators account, click the “Pause updates for 7 days” button, then click it again and again, if necessary, until you’re paused out into late March or early April.

If you see an Optional update available (you can see one in the screenshot), DON’T click “Download and install.” You’ll be bit by those bugs soon enough.

Don’t be spooked. Don’t be stampeded. And don’t install any patches that require you to click “Download and install.” 

If there are any immediate widespread problems protected by this month’s Patch Tuesday — a rare occurrence, but it does happen — we’ll let you know here, and at, in very short order. Otherwise, sit back secure in the knowledge that you aren’t in the first round of cannon fodder. Let’s see what problems arise.

We’re at MS-DEFCON 2 on AskWoody.

Copyright © 2020 IDG Communications, Inc.

Source link

The mess behind Microsoft’s yanked UEFI patch KB 4524244

Remember the warning about watching how sausage is made? This is an electronic sausage-making story with lots of dirty little bits.

First, the chronology. On February’s Patch Tuesday, Microsoft released a bizarre standalone security patch, KB 4524244, which was then called “Security update for Windows 10, version 1607, 1703, 1709, 1803, 1809, and 1903: Feb. 11, 2020.” The name has changed, but bear with me.

The original problems with KB 4524244

That patch had all sorts of weird hallmarks as I discussed at the time:

  • It’s a standalone security patch. We don’t get standalone security patches anymore. They’re almost invariably rolled into cumulative updates.
  • It appeared to be directed at one wayward UEFI boot manager. From the KB article:

Addresses an issue in which a third-party Unified Extensible Firmware Interface (UEFI) boot manager might expose UEFI-enabled computers to a security vulnerability.

  • The Knowledge Base article title was clearly wrong. Win10 version 1909 wasn’t mentioned in the KB article, but the 1909 patch appeared in the Microsoft Catalog. 

That buggy patch was accompanied by a parallel patch for older versions of Windows, KB 4502496, called “Security update for Windows 10, version 1507, Windows 8.1, RT 8.1, Server 2012 R2, and Server 2012: February 11, 2020.” This time the name was correct. But the Win8.1/1507 patch had the same bugs and met the same fate as its more illustrious co-conspirator, KB 4524244.

What went awry

The patch wreaked havoc on many PCs, most notably HP PCs with Ryzen processors. HP owners with Secure Boot enabled (more about that later) reported that their PCs wouldn’t reboot normally and, when forced, the HP BIOS said it detected an unauthorized change to the secure boot keys and had to restore.

There’s a second bug in the patches, identified separately in the Windows Release Information status page:

Using the “Reset this PC” feature, also called “Push Button Reset” or PBR, might fail. You might restart into recovery with “Choose an option” at the top of the screen with various options or you might restart to your desktop and receive the error “There was a problem resetting your PC”.

The files inside the patch were dated September 2019 — five months ago. As @abbodi86 says on AskWoody:

The patch was first created in September 2019, so it was in testing for almost 5 months, and that still was not enough to get it right.

Microsoft has known about the UEFI loader security problem since April 2019, if not earlier. It took ten months to push a fix — and a buggy fix at that.

Microsoft-authorized rootkits

So what, really, was being patched in KB 4524244? The official description then, and even now, has very little substance.

It didn’t take long for the Twitterverse to point the finger at Kaspersky as the source of the faulty UEFI boot manager, but why would Microsoft issue a separate Windows patch (actually, two patches) specifically to block Kaspersky’s product? And what had Kaspersky done to deserve such treatment?

That brings us to the sausage-making part of the story.

Kaspersky, like other antivirus companies, includes the ability to create a boot disk — in this case, the “Kaspersky Rescue Disk” — that’ll let you boot your computer even if your PC’s internals have been compromised. In order to use the Kaspersky Rescue Disk, like other recovery boot disks, you have to have physical access to the PC.

The problem is that an older version of the Kaspersky Rescue Disk allowed attackers with physical access to your machine to boot the PC into a potentially harmful operating system, even if you have Secure Boot enabled. Secure Boot is supposed to make it impossible to use a recovery disk to boot into any operating system that hasn’t been pre-approved, but this older version of the Kaspersky Rescue Disk didn’t follow the Secure Boot rules.

Kaspersky learned of the security hole in April 2019, plugged it on systems running Kaspersky endpoint protection, but didn’t release an update to the Kaspersky Rescue Disk until August 2019. 

Compounding the problem is the fact that Microsoft signed the old Kaspersky Rescue Disk program, so Secure Boot continued to recognize old Kaspersky Rescue Disks as valid up until earlier this month. You can mince terminology, and argue that every antivirus manufacturer does it, but any way you slice it the Kaspersky Rescue Disk program is a rootkit or, more exactly, a bootkit.

If it sounds weird that Microsoft would sign a Kaspersky program — a rootkit routine, at that — it isn’t. Russian blogger ValdikSS explained the conundrum in his April 2019 post “Exploiting signed bootloaders to circumvent UEFI Secure Boot:

Modern PC motherboards’ firmware follow UEFI specification since 2010. In 2013, a new technology called Secure Boot appeared, intended to prevent bootkits from being installed and run. Secure Boot prevents the execution of unsigned or untrusted program code (.efi programs and operating system boot loaders, additional hardware firmware like video card and network adapter OPROMs).

Secure Boot can be disabled on any retail motherboard, but a mandatory requirement for changing its state is physical presence of the user at the computer. It is necessary to enter UEFI settings when the computer boots, and only then it’s possible to change Secure Boot settings.

Most motherboards include only Microsoft keys as trusted, which forces bootable software vendors to ask Microsoft to sign their bootloaders. This process include code audit procedure and justification for the need to sign their file with globally trusted key if they want the disk or USB flash to work in Secure Boot mode without adding their key on each computer manually.

So Microsoft did, and does, quite intentionally, sign rootkits. Er, bootkits. That way, emergency restore disks can work. 

Revoking the UEFI signature

Microsoft can change its mind about the security clearance of its Microsoft-approved UEFI bypass programs any time, but to do so it has to add the no-longer-trusted app to something called a UEFI Revocation List File, which in turn updates the Secure Boot Forbidden Signature Database. 

Still with me?

Here’s the problem. KB 4524244 and KB 4502496 add the old Kaspersky Rescue Disk routine to your PC’s Secure Boot Forbidden Signature Database, so it won’t be recognized as a Microsoft-approved app. But, for reasons that aren’t at all clear, monkeying around with the UEFI Secure Boot restrictions broke other programs — most notably the boot routine for HP PCs with Ryzen processors. There may be other collateral damage.

Somebody at Microsoft may know what went belly-up, but they certainly aren’t telling anybody.

What did Kaspersky do wrong?

Nothing. Other than distributing a Kaspersky Rescue Disk program, prior to August 2019, that could be used for nefarious purposes. 

Kaspersky has a detailed — and, as far as I can tell, accurate — accounting of the debacle in a newly released FAQ

The key conclusion, “Kaspersky products have not been a cause of this issue,” referring to the bugs in KB 4524244, rings true. The problem lies in some other conflict, which went unfixed in five months of testing.

It appears as if Microsoft had just tested its patch on an HP machine with a Ryzen processor we wouldn’t be in this mess. But … Microsoft.

What’s next?

Microsoft has yanked the patch. It won’t be pushed onto your machine. You can’t even download it from the Update Catalog. 

If you installed KB 4524244 or KB 4502496 on your PC (Start > Settings > Update & Security, click View update history) and your machine still works, you’re fine. The old Kaspersky Rescue Disk signature is in your Secure Boot Forbidden Signature Database, and you’re no longer at risk from someone slipping a malicious disk into your machine.

If you installed the update and your machine won’t boot (yet another good reason to avoid installing patches right away, eh?), Microsoft has details for restoring your PC to health in the KB article (which now mentions Win10 version 1909) and on the Windows Release Information Status page. The instructions tell you how to uninstall the patch. For machines with the “Reset this PC” bug, Microsoft also recommends that you follow the uninstall with a run of Reset this PC. I have no idea why uninstalling the patch and running Reset restores machines to a working state, but apparently it does.

If you haven’t yet installed the patch, be of good cheer. Microsoft will come up with a suitable fix at some point in the future. As both the KB article and the Release Information Page promise:

We are working on an improved version of this update in coordination with our partners and will release it in a future update.

Let’s hope the “improved version” works better than the old one — and that it takes less than ten months to respond to the problem. Meanwhile, ValdikSS warns in a tweet:

At least 2 other vuln bootloaders exist, not revoked.

For joy.

As best I can tell, Microsoft hasn’t published any details about this fiasco, other than yanking the patch, identifying the bugs and promising a fix. Security, meet obscurity.

Follow the play-by-play on

Copyright © 2020 IDG Communications, Inc.

Source link

A large – but manageable – February Patch Tuesday brings critical browser updates

With 99 reported vulnerabilities and patches to both Microsoft browsers, Office and Windows, this month’s Patch Tuesday update is not as large an administrative burden as you might initially think. We’ve rated the browser updates as a “Patch Now” update due to issues with the Chakra engine, but both Office and Windows can be scheduled according to a regular patch cadence. Unfortunately, we have another Adobe Flash update to deploy, but no critical development updates for February.

You can find more information in our helpful infographic here.

Known issues

Each month, Microsoft includes a list of known issues that relate to the operating system and platforms included in this update cycle. I have referenced a few key issues that relate to the latest builds from Microsoft including:

  • Microsoft Cluster Shared Volumes (CSV) can still generate the error message,” “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).” Microsoft is still working on a solution. Until a fix is released, you can try the operation as an administrator or try to “own” directories in question before the operation.
  • After installing some Asian language packs you may still (see KB4493509) receive the error, “0x800f0982 – PSFX_E_MATCHING_COMPONENT_NOT_FOUND.”

Microsoft has been working on a fix for both these issues for a while now; we don’t expect a resolution any time soon.

Major revisions

This month, two CVEs have undergone a major revision increment:

  • CVE-2019-1332: CVE information revised to announce the availability of Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (CU) and Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR).
  • CVE-2019-8267: Microsoft revised this to include Internet Explorer 11 installed on all supported editions of Windows 10 Version 1809, Windows Server 2019, Windows 10 Version 1903, and Windows 10 Version 1909 because they are affected by this vulnerability. This change may affect your server update cycle

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

  • Browsers (Microsoft IE and Edge)
  • Microsoft Windows (both desktop and server)
  • Microsoft Office (Including Web Apps and Exchange)
  • Microsoft Development platforms ( ASP.NET Core, .NET Core and Chakra Core)
  • Cloud and Devices
  • Adobe Flash Player (to be discontinued)


Microsoft has released nine updates to both browsers (Internet Explorer and Edge) this month, with five rated as critical, two as moderate and the remaining two as important. The biggest concerns are the four critical updates to the Chakra core scripting engine that could lead to remote code execution.

Microsoft advises that these four critical vulnerabilities could lead to a scenario where “An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”

Add this update to your “Patch Now” schedule.

Microsoft Windows

Ok, this may sound like a lot of updates: Microsoft has released 79 patches to the Windows desktop and server ecosystem. Five of these updates are rated as critical and the rest are all rated as important by Microsoft. It sounds (and feels) like a lot of patches, but other than the critical updates to the Remote Desktop (RDP) platform, the administrative burden is not that great.

This patch cycle feels more like an administrative cycle than that one that addresses critical or exploited vulnerabilities. It’s “clean-up” time for Microsoft after the Christmas break and a very light January patch cycle.

Add these updates to your standard release schedule. 

Microsoft Office

Microsoft has released six updates to Microsoft Office – all rated as important. The most serious for this month affects Microsoft Excel with a potential (but difficult-to-exploit) remote code execution scenario involving how Excel handles objects in memory. All of this month’s reported vulnerabilities require access to the target system and require users to take explicit action on vulnerable systems. There is an update this month to Microsoft SharePoint server which will require a reboot of all affected servers.

Add these Office patches to your regularly scheduled updates

Microsoft development platforms

This month, Microsoft has not released any updates to the many variations of .NET, but we do have one update to SQL Server that has been rated as important. CVE-2020-0618 is relatively difficult to exploit, as it requires access to the SQL server instance and requires specially crafted pages sent to the SQL Server Reporting services.

Add this update to your regularly scheduled patch release cadences.

Cloud and Devices

We have allocated this space to the recent cloud (Azure) and device updates from Microsoft. This month, Microsoft has not released any Azure related patches, but has published a Microsoft Surface (device level) patch (CVE-2020-0702) that has been rated as important (and difficult to exploit).

Add this device related update to your regular patch cycle.

Adobe Flash Player

I thought that we were done with critical Adobe Flash Player updates from Microsoft. I even instructed our development team to remove this section from our internal bulletins. Well, they (Flash Player) updates are back, with a vengeance.

This month, we see another ActiveX flaw in Flash Player (ADV20003/CVE-2020-3757) that could lead to the execution of arbitrary code on the compromised computer. According to the Adobe security bulletin, “The vulnerability exists due to a type confusion error when processing Flash content. A remote attacker can create a specially crafted .SWF file, trick the victim into playing it, trigger a type confusion error and execute arbitrary code on the target system. Successful exploitation of this vulnerability may result in complete compromise of the target system.”

Microsoft has documented a potential work-around relating to the Flash ActiveX control which includes making the following registry changes:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{D27CDB6E-AE6D-11CF-96B8-444553540000}]

“Compatibility Flags”=dword:00000400

[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftInternet ExplorerActiveX Compatibility{D27CDB6E-AE6D-11CF-96B8-444553540000}]

“Compatibility Flags”=dword:00000400

Add this update to your “Patch Now” release schedule.

Copyright © 2020 IDG Communications, Inc.

Source link