"> Tuesday Archives - Engr Kabir Saleh

Posts Tagged


Get the January 2020 Patch Tuesday patches installed

This month has seen a whole lotta hand waving and sky-is-falling-caliber rhetoric, but the reality is much more prosaic. If you aren’t running a major network (and thus aren’t susceptible to the imminent problems with Remote Desktop Gateway, the Citrix network bugs or the whopping 334 patches in Oracle), there’s been little reason to install this month’s updates. 

Still, work on cracking the CurveBall CVE-2020-0601 security hole continues at a furious pace. Some security companies are using CurveBall to sell more product, but the free Microsoft Defender catches at least some afflicted programs; Firefox, Chrome and Edge won’t fall for it; and pre-Win10 versions of Windows (Seven Semper Fi!) have never been exposed.

With several working proof-of-concept routines readily available — but no attacks, and indeed no sign that a general attack is imminent — patching for CurveBall falls in the “abundance of caution” bucket. Since we’ve seen few weird problems with the January patches, now seems like a good time to get patched up.

As usual, Patch Lady Susan Bradley has a detailed analysis in her Patch Watch column with a full patch-by-patch reckoning in her Master Patch List (paywall; donation requested).

Here’s how to get your system updated the (relatively) safe way.

Make a full backup

Make a full system image backup before you install the latest patches.

There’s a non-zero chance that the patches — even the latest, greatest patches of patches of patches — will hose your machine. Best to have a backup that you can reinstall even if your machine refuses to boot. This, in addition to the usual need for System Restore points.

There are plenty of full-image backup products, including at least two good free ones: Macrium Reflect Free and EaseUS Todo Backup

Patch Win7, Win8.1 or associated servers

This is the last month we’ll see free Win7 patches — or so we’ve been promised. (I find it hard to believe that Microsoft won’t patch the Win7 Internet Explorer JScript security hole CVE-2020-0674, but Microsoft, eh?)

As for those of you Win7 holdouts worried about sprouting a black wallpaper due to the Win7 January “Stretch” bug, Microsoft now advises:

We are working on a resolution and will provide an update in an upcoming release for organizations who have purchased Windows 7 Extended Security Updates (ESU).

Nice guys. 

Bottom line, for you Win7 folks: Do yourself a favor and change your wallpaper so it isn’t Stretched, before installing the buggy January patch. Follow Lawrence Abrams’s instructions on BleepingComputer.

Microsoft is blocking updates to Windows 7 and 8.1 on recent computers. If you are running Windows 7 or 8.1 on a PC that’s 24 months old or newer, follow the instructions in AKB 2000006 or @MrBrian’s summary of @radosuaf’s method to make sure you can use Windows Update to get updates applied.

For most Windows 7 and 8.1 users, I recommend following AKB 2000004: How to apply the Win7 and 8.1 Monthly Rollups. You should have one Windows patch, dated Jan. 14 (the Patch Tuesday patch). If you see a Monthly Rollup Preview, ignore it.

If you insist on manually installing Security-only patches for Win7 and Server 2008 (I call that the “Group B” approach on AskWoody), get the full list from @PKCano on the AskWoody site. If in doubt, ask questions on the site! It’s easy and free.

Realize that some or all of the expected patches for January may not show up or, if they do show up, may not be checked. DON’T CHECK any unchecked patches. Unless you’re very sure of yourself, DON’T GO LOOKING for additional patches. In particular, if you install the January Monthly Rollup, you won’t need (and probably won’t see) the concomitant patches for December. Don’t mess with Mother Microsoft.

If you see KB 4493132, the “Get Windows 10” nag patch, make sure it’s unchecked.

Watch out for driver updates — you’re far better off getting them from a manufacturer’s website.

After you’ve installed the latest Monthly Rollup, if you’re intent on minimizing Microsoft’s snooping, run through the steps in AKB 2000007: Turning off the worst Win7 and 8.1 snooping. If you want to thoroughly cut out the telemetry, see @abbodi86’s detailed instructions in AKB 2000012: How To Neutralize Telemetry and Sustain Windows 7 and 8.1 Monthly Rollup Model.

If you’re worried about Windows 7 hitting end-of-support, don’t be alarmed. The first missed security patch isn’t until next month. Besides, you have lots of alternatives, and not all of them involve Windows. We watch your options intently in the Seven Semper Fi series on AskWoody.

Patch Win10 and associated servers

If you’re running Win10 version 1803, 1809, Server 1809, Server 2019, or any earlier version of Windows 10, I urge you to upgrade to Win10 version 1903. (You can find your version by typing winver in the Search box in the lower left corner and pressing Enter.) There are detailed instructions in the article Why — and how — I’m moving Win10 production machines to version 1903.

Win10 1903 is far from perfect, but it seems to be relatively stable at this point. The one huge advantage to version 1903: It lets everybody pause updates with a few simple clicks. That feature has my vote for the most important (perhaps the only important) upgrade to Win10 in the past four years.

If you insist on using Win10 version 1809, go through the steps in All’s clear to install Microsoft’s November patches to get 1809 updated. If you’re on Win10 1909, I figure you’ve jumped the gun, but the following instructions will work.

If you’ve been following my usual advice — to click “Pause updates for 7 days” three times — your machine is probably waiting further instructions, displaying an “Updates paused” notice in the Windows Update pane (Start > Settings (the gear icon) > Update & Security > Windows Update). If you see that updates have been paused, click “Resume updates.” Windows will go out and install the January cumulative update, plus any other ancillary patches (for example, for .Net) that you require.

I’m very happy to say that clicking “Resume updates” will not automatically move you to Win10 version 1909. In order to move to the next version — which continues to suffer from bugs, most notably the File Explorer Search bug — you need to click a link that says, “Download and install now.” Don’t click it.

Once you’re updated and rebooted, pause updates for 28 days: Click Start > Settings > Update & Security. Click Windows Update on the left side, then click “Pause updates for 7 days.” Next, click on the newly revealed link, which says “Pause updates for 7 more days,” and click it again, and one last time, for a total of four clicks. That pauses all updates for 28 days, until Feb. 21. With a little luck that’ll be long enough for Microsoft to fix any bugs it introduces in February.

If you see an offer of an Optional update (screenshot), don’t click Download and install now. There’s a reason why Microsoft deems such patches “optional.”

1909 download and install now Woody Leonhard/IDG

February’s Patch Tuesday is on the 11th. That’ll be the first day Win7 users will miss a security update (unless they pay for it). Expect much hand wringing and clucking, but not many fireworks.

Thanks to the dozens of volunteers on AskWoody who contribute mightily, especially @sb, @PKCano, @abbodi86 and many others.

We’ve moved to MS-DEFCON 3 on the AskWoody Lounge.

Copyright © 2020 IDG Communications, Inc.

Source link

Time-Machine Tuesday: That’s really escalating the problem

Pilot fish gets a help desk call from a user who says he’s bringing his laptop to IT to fix a problem he’s having with printing.

No problem, fish says, we handle that kind of issue all the time.

But the rest of the day passes without the user appearing.

Next morning, user’s boss does show up at the IT department with the laptop, and explains that the user is out sick.

But the laptop clearly has more than printing problems. The display is dangling by a cable, the keyboard is unusable, and the machine is pretty much trashed.

“Turns out the user was bringing the laptop to the IT office,” says fish. “But while crossing between buildings, he was unlucky enough to walk under a large falling icicle, which not only seriously injured the user but sent the laptop flying.

“His boss was still sure we could ‘just put it back together.’”

Stay safe inside and send Sharky your true tales of IT life at [email protected]. You can also subscribe to the Daily Shark Newsletter.

Copyright © 2020 IDG Communications, Inc.

Source link

Patch Tuesday aftermath: The NSA Crypt32 threat is real, but not yet imminent

Get ready for your local news station’s weather reporter to start lecturing on the importance of installing Windows patches.

Yesterday we were treated to a remarkable Patch Tuesday. “Remarkable” specifically in the sense that the U.S. National Security Agency was moved to put out a press release (PDF):

NSA recommends installing all January 2020 Patch Tuesday patches as soon as possible to effectively mitigate the vulnerability on all Windows 10 and Windows Server 2016/2019 systems.

That’s a first. Until now, the NSA has never publicly acknowledged its contributions to Microsoft’s patching efforts — nor has it picked up the flogging whip in Microsoft’s patching drive. Security guru Brian Krebs attributes it to a change of heart at the NSA:

Sources say this disclosure from NSA is planned to be the first of many as part of a new initiative at NSA dubbed “Turn a New Leaf,” aimed at making more of the agency’s vulnerability research available to major software vendors and ultimately to the public.

Krebs has an excellent overview of the security hole, loaded with several mind-bending analogies. Get the tech details of the vulnerability in Kenneth White’s Microsoft’s Chain of Fools exposé. If you haven’t yet been inundated with half-fast explanations, rest assured that every news outlet in the world is in the process of trying to digest and regurgitate the complexities of CryptoAPI and Elliptic Curve Cryptography certs.

What does it all mean? If someone can crack the CVE-2020-0601 conundrum, they’ll be able to create programs that appear to come from a trusted source. That’s a scary possibility, but it’s a long way from a third-degree polynomial to working ransomware.

And, no, CVE-2020-0601 can’t be used to break into the Windows Update chain.

As of early Wednesday morning, at least one A-list hacker has put together a working “Proof of Concept” exploit. Casey Smith (@subTee) has a PoC, but it isn’t yet ready for widespread release. As Kevin Beaumont says, “It’s not practical at scale for a variety of reasons.”

So with everybody — the NSA, the ‘Softies, your weather forecaster, your hairdresser’s boyfriend’s precocious but smelly nine-year-old — recommending that you patch NOW, why wait?

Because there are problems with this month’s Win10 patches.

It always takes time for bugs to surface. This month’s no different. As of very early Wednesday morning, I’m seeing plenty of problem reports when installing the patches — the same problems we’ve had for many years. Whether any darker problems lie in lurk is anybody’s guess, and it’s still too early to tell.

For now, I’m recommending that you keep all of the Patch Tuesday patches at bay, until we’ve had a chance to see what other surprises await. That assessment may change quickly, so stay alert.

If you’re in charge of Server 2012, 2012 R2, 2016 and/or 2019 systems, there’s a much larger problem you should confront right now. Two of this month’s patched security holes, CVE-2020-0609 and CVE-2020-0610, reveal a security hole in the Windows Remote Desktop Gateway, RDgateway, that will let anybody into your system if they crawl in through port 443. As Patch Lady Susan Bradley puts it:

If you are a IT consultant or admin with an Essentials 2012 (or later) server, or use the RDgateway role and expose it over port 443 to allow users to gain access to RDweb or their desktops, forget that crypt32.dll bug. This one is one to worry about.

The January patches should be a top priority for this, active security hole. And of course, if you’re using Pulse Connect Secure VPN, or a Citrix Gateway/ADC/NetScaler box you have it locked down (or unplugged) by now, right?

This month we had almost no non-security “quality updates” — which is to say, bug fixes. With a few niggling exceptions (one in Win10 version 1809), none of the Windows patches this month include documented non-security bug fixes. In fact, we’ve seen very few non-security patches since October. 

All of which underlines an ongoing problem with the “as a Service” method of bundling all the month’s patches into one big gob. If we had separate Crypt32 and RDgateway patches, people could choose to fix the big holes while waiting for problem reports on the little ones. 

If wishes were horses then hackers would ride.

Stay up-to-the-minute on Crypt32 cracking with AskWoody.com.

Copyright © 2020 IDG Communications, Inc.

Source link

Today’s Patch Tuesday brings fireworks and — a magic bullet?

Over the past few years we’ve seen a few security holes that have drawn Chicken Little warnings and vast amounts of unthinking press reports. When you turn on a local news program and hear from the hometown weather reporter that you really need to get Windows patched, a bit of skepticism might be in order.

Today’s Patch Tuesday appears to be headed down the same well-worn chute.

Brian Krebs, the security guru with impeccable credentials, fired an opening salvo in his blog post yesterday:

Sources tell KrebsOnSecurity that Microsoft Corp. is slated to release a software update on Tuesday to fix an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of Windows. Those sources say Microsoft has quietly shipped a patch for the bug to branches of the U.S. military and to other high-value customers/targets that manage key Internet infrastructure, and that those organizations have been asked to sign agreements preventing them from disclosing details of the flaw prior to Jan. 14, the first Patch Tuesday of 2020.

On the one side, we have Will Dorman, a highly respected analyst at the federal CERT Coordination Center, who tweeted:

I get the impression that people should perhaps pay very close attention to installing tomorrow’s Microsoft Patch Tuesday updates in a timely manner. Even more so than others. I don’t know… just call it a hunch? ¯_(ツ)_/¯

On the other hand we have Kevin Beaumont, my favorite plucky porg down in the trenches, who says, simply:

Don’t panic re this one.

A bit of histrionic history here.

Back on Monday — not Tuesday, mind you, but Monday — Sept. 23, Microsoft released a highly publicized out-of-band patch for an “exploited” Internet Explorer 0day known as CVE-2019-1367. The fix was so badly botched that Microsoft ended up releasing four separate fixes for it, over the course of three weeks, and many (millions?) of Windows customers got caught up in the bugs. The security hole itself? It never amounted to a hill of beans.

In November we got a similar treatment for  CVE-2019-1429, a scary “exploited” monster that never materialized. In December, it was  CVE-2019-1458, which has since sunk into obscurity. Back in September, we had emergency warnings about two “exploited” security holes, CVE-2019-1214 and CVE-2019-1215. A few days later, without any announcement, Microsoft removed the “exploited” designation

Then there was the DejaBlue fiasco. Beaumont, who named the security hole and followed it closely, never found a real-world working exploit (although there were several in-the-lab, proof of concept, sorta exploits).

Granted, there have been significant security holes announced with full fanfare, including their own dedicated websites and logos. The most recent real threat came in the form of BlueKeep, announced and patched in May, which actually had a working exploit that appeared in September. Even the NSA warned about it. You had four months or so to get patched. (Full disclosure: I joined the Chicken Little crowd and recommended early patching for BlueKeep, when it wasn’t necessary.)

Many patch-it-now hardliners hearken back to WannaCry, which cut a wide swath back in May, 2017. With its origins in NSA-written hacking code, WannaCry did pose a significant threat, but Microsoft had already released its WannaCry patch, MS17-010, two months before WannaCry appeared.  

I’m not saying that you need to put on rose-colored glasses and “la-la-la” your way through today’s Patch Tuesday shenanigans. But I am saying that a certain amount of restraint could go a long way — especially given Microsoft’s track record for botched Patch Tuesdays.

Join us for a ringside seat as the patches (and problems!) roll out, on AskWoody.com.

Copyright © 2020 IDG Communications, Inc.

Source link

With Patch Tuesday arriving tomorrow, get Windows Automatic Update under control

December was a remarkable patching month. For those of you who use Windows Update, there were few surprises. (Manual updaters had it rough, though.) If you’ve been following along, you’ve already installed the December updates. Great. It’s time to get ready for January by temporarily turning off Windows Automatic Update.

If you’re a member of the “Get patched as soon as they roll out” team (a shrinking cohort, from my observation, anyway), my hat’s off to you. We need all the cannon fodder we can get. Be sure to keep us updated on AskWoody.

But if you figure there’s more danger from Pavlovian patching practices than from malware immediately following a Patch Tuesday, there are reasonably easy alternatives. Wait while we all watch the unpaid beta-testers take one for the Gipper.

Blocking automatic update on Win7 and 8.1

If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Yes, this month’s Patch Tuesday brings the last free security patches for Win7. No, you shouldn’t let them install by themselves. We’ll have a lot of coverage of Win7 weaning worries in the coming weeks.

Blocking automatic update on Win10 1803 or 1809

Not sure which version of Win10 you’re running? Down in the Search box, near the Start button, type About, then click About your PC. The version number appears on the right under Windows specifications.

If you’re using Win10 1803 or 1809, I strongly urge you to move on to Win10 version 1903. Microsoft released it (to some consternation) in May of last year. It had a shaky start before plunging into a four-patch debacle in September/October, but now appears to be relatively stable. There are detailed step-by-step instructions for moving to Win10 1903 in “Why — and how — I’m moving Win10 production machines to version 1903.”

If you insist on sticking with Win10 1809 (thrice bitten, thrice shy, eh?), you can block updates by following the steps in last month’s Patch Tuesday warning.

There’s a better way with Win10 versions 1903 or 1909

In version 1903 or 1909 (either Home, Pro, Education or Enterprise, unless you’re attached up an update server), using an administrator account, click Start > Settings > Update & Security. At the top, click the Pause updates for 7 days button. 

1903 pause 7 days 4 Woody Leonhard/IDG

That button changes so it says, “Pause updates for 7 more days.” Click it two more times, for a total of 21 paused days. That defers all updates on your machines until 21 days after you click the button. Once set, you can’t extend the deferral any longer unless you install all the outstanding cumulative updates to that point.

Historically, 21 days has sufficed to avoid the worst problems, although the aforementioned Keystone Kops IE 0day patch bugs persisted for more than three weeks. 

If there are any immediate widespread problems protected by this month’s Patch Tuesday — a rare occurrence, but it does happen — we’ll let you know here, and at AskWoody.com, in very short order.

We’re at MS-DEFCON 2 on AskWoody.

Copyright © 2020 IDG Communications, Inc.

Source link

Time-Machine Tuesday: Does Safari ring a bell?

This pilot fish works on the website for a TV station. “We just updated the CSS on our website,” fish says. “After completing the upgrade, I sent out an email to a number of station employees, including my boss.

“I told them the upgrade was complete and we had tested it with a number of browsers including IE 7, IE 8, Firefox, Chrome and Opera, and found no issues with any of them.

“A few hours later I received a short email from my boss: ‘What are IE 7, IE 8 and Firefox?’ For some reason he didn’t ask what Chrome and Opera were.

“This is the guy who determines my income and if I keep my job or not!”

Sharky is the guy who determines which true tales of IT life make it into the Shark Tank. Send me yours at [email protected]. You can also subscribe to the Daily Shark Newsletter.

To read this article in full, please click here

Source link

Time-Machine Tuesday: We’re picturing two bathtubs in a field

This small software company does almost all its customer support through email, reports a pilot fish there.

“For the first two years I was there, all support email was handled via Outlook,” fish says. “However, we started to grow, and using Outlook became impractical; people started double-answering the same message.”

So company invests in a new support ticketing system that will allow better tracking of tickets and who is assigned to what.

The company’s lead support tech tests the new system for several weeks, and everything appears to be working fine. The rest of the techs are trained. The system is announced to customers as a big step forward in support. As a last step before launch, the support people create signatures to attach to all their outgoing messages to customers.

To read this article in full, please click here

Source link

Just a few more updates for 2019 makes for a light December Patch Tuesday

December brings peace and joy – well, maybe – but at least Microsoft has provided us with a relatively easy Patch Tuesday update. There is an urgent update to Microsoft Internet Explorer 11 and three critical updates to the Windows platform that will require some attention this month. In addition, we have cumulative updates for the .NET and SQL server platforms that will require some testing before general deployment. That said, I think that 2020 will bring many interesting Patch Tuesdays with Microsoft’s new “staged” feature releases already included Windows 10 1909. You can find out more here on our Readiness blog infographic.

Known issues

Each month, we try to highlight some of the more serious issues with this month’s and past updates to Microsoft desktop, server and development platforms. I have included a few that are likely to affect this month’s update cycle including: 

  • Office 2013 and Office 2016: You may receive the following message, “This application is not trusted to consume rights managed content. The Authenticode signature for the application is not valid. Contact your administrator for further investigation.” To resolve this issue, install Office update 3172523.
  • Windows 10 1803 onwards: When setting up a new Windows device during the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages. Microsoft is working on this one. IME’s are very complex keyboard input “layers” that reside across multiple builds and configurations requiring massively disparate linguistic skills to debug. From my experience with installing/configuring/breaking IME’s in Asia (in the late 90’s) I suspect that we may see this issue again.
  • Across all Windows desktop and server builds, we have the following ongoing issue, “Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.”
  • Microsoft is aware of an issue in Windows Hello for Business (WHfB) with public keys that persist after a device is removed from Active Directory, if the AD exists. After a user sets up Windows Hello for Business (WHfB), the WHfB public key is written to the on-premises Active Directory. The WHfB keys are tied to a user and a device that has been added to Azure AD, and if the device is removed, the corresponding WHfB key is considered orphaned.

And thanks to Woody Leonard (Ask Woody), for picking up on the offering of Autopilot. Just like in October, it looks like the Autopilot patch is once again being offered to all Pro machines, whether they have Autopilot or not.

Major revisions

No major revisions have been published this month from Microsoft.

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

  • Browsers (Microsoft IE and Edge)
  • Microsoft Windows (both desktop and server)
  • Microsoft Office (Including Web Apps and Exchange)
  • Microsoft Development platforms (NET Core, .NET Core and Chakra Core)
  • Adobe Flash Player


You now have something to talk about at the annual Christmas party. For this December update there is (only) a single reported vulnerability for all of Microsoft’s browsers. While this is an absolutely huge improvement over the sometimes “tens” of urgent “Patch Now” memory corruption vulnerabilities, this success is somewhat tempered by the fact that we are still fixing VBScript issues (CVE-2019-1485) in 2019. So, Microsoft has released a single critical update for Internet Explorer 11 that really does require urgent attention due to its link to ActiveX and its potential exploitability. Add this update to your “Patch Now” schedule, if you are still using IE11.


Microsoft has addressed a total of 21 vulnerabilities on the Windows platform for this December Patch Tuesday with three rated as critical (CVE-2019-1471, CVE-2019-1468 and ADV990001) and the remaining 18 rated as important. The critical rated vulnerabilities could lead to remote code execution scenarios with multiple vectors for bad actors to attack the compromised platform. In addition to these security issues there are several new features “included” but not released with Windows 10 1909. Microsoft offered the following explanation:

“Windows 10, versions 1903 and 1909 share a common core operating system and an identical set of system files. As a result, the new features in Windows 10, version 1909 were included in the recent monthly quality update for Windows 10, version 1903 (released October 8, 2019), but are currently in a dormant state. These new features will remain dormant until they are turned on using an enablement package, which is a small, quick-to-install “master switch” that simply activates the Windows 10, version 1909 features.”

This is revolutionary stuff, maybe a little scary. Microsoft is basically saying, “we have changed some stuff, added some stuff, and will let you know about it later.” I would really like a definitive list of new features, the impact and dependencies and a plan of when these changes are going to be implemented. Which I think most deployment engineers would consider reasonable. Given the usual holiday season staffing issues and the lack of clarity around these changes, I suggest that some testing (and waiting) may be advised before a general roll-out of these Windows updates.

Microsoft Office

December has not been so kind to the Microsoft Office suite, with six reported vulnerabilities, all rated as important by Microsoft. Microsoft does not publish the risk rating or Common Vulnerability Scoring System (CVSS) for individual Microsoft Office updates, but this patch group has a very high rating of 9.8. If you are using Office 365 then you may have experienced issues with patch downloads. The issue affects channels 1808 to 1911 and more information can be found here. There is a remote code execution scenario for Microsoft PowerPoint (CVE-2019-1462) that may need some urgent attention but the other updates should be included in your standard update release schedule. 

Microsoft Development Tools

Microsoft’s Git development application is the main victim/offender this month with five serious vulnerabilities (CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387) and one moderate and one important update. We have not seen any other updates to the Visual Studio platform or more importantly to Azure for this month. All versions of the Microsoft .Net development platform will receive a cumulative update package (KB4533002) with the special note from Microsoft stating that, “This update is included in the Quality Rollup that’s dated December 10, 2019. Parts of this update were previously released in the Quality Rollup that’s dated September 10, 2019.” I’m not sure what to do with this information. Sigh. Add this update to your standard release schedule.

Microsoft SQL Server gets a special mention this month with two cumulative updates released (CU 18 KB 4527377 and CU 11 KB 4527378). As Microsoft employs the “pure cumulative” model to all SQL Server patches and releases, all previously released hotfixes (including Critical On Demand patches) are included and “more thoroughly” tested. You can read more about Microsoft SQL Server patch strategies and models here and here respectively. Unless you have a critical dependency on the GIT application, then please add this month’s update to your standard release schedule. 


Adobe has addressed 17 critical security updates which are not included in this month’s Microsoft Patch Tuesday as all of these issues relate to product level issues (Adobe Reader and Acrobat) rather than widely used desktop and server components (i.e. Flash). Affected applications include Acrobat Reader, Photoshop, Illustrator and Brackets. In Adobe Acrobat and Reader, Adobe fixed 14 critical arbitrary code execution flaws, including out-of-bounds write glitches, use after free flaws, untrusted pointer dereference vulnerabilities, heap overflow errors, buffer errors and a security bypass. You can find more APSB19-55 This a huge month for Adobe security issues – but not a big issue for desktop deployment engineers. For December, may I add, it is definitely not “margarita time”…but you don’t have to deploy any urgent desktop or server updates courtesy of Adobe.

I wanted to spend a few moments thanking everyone for their feedback and their attention over the past year. I love writing about this stuff, and I hope that I have helped a few people out, and maybe saved someone a little time each month. Thank you – and I look forward to more updates, more patches and much more in 2020.

This article is published as part of the IDG Contributor Network. Want to Join?

Copyright © 2019 IDG Communications, Inc.

Source link

Patch Tuesday brings a reprise of the Autopilot debacle, now quashed, and another Win7 nag

Patch Tuesday in December rarely brings anything worthwhile — everybody’s on vacation, or wants to be on vacation — and this month’s no exception. We got patches for 36 separately identified security holes and two new advisories, full of sound and fury but covering very little.

The one “exploited” security hole — CVE-2019-1458 Win32k Elevation of Privilege Vulnerability — shouldn’t cause any heartburn. Microsoft says:

To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.

Then Microsoft gives the hole an “Important” severity rating, a big step below the “Critical” that’s de rigeur. Short version: Although you need to patch sooner or later, you don’t need to worry about any of the security holes right now.

The return of Autopilot

Remember back in October when Microsoft mysteriously pushed out a patch for Autopilot, a little-known app that helps companies set up new machines? I wrote about it in “Microsoft pushes, then yanks, rogue kinda-security patch KB 4523786, ostensibly for Autopilot.” 

Looks like the cows are out of the barn again. Microsoft released KB 4532441 yesterday, the latest “Cumulative update for Autopilot in Windows 10, versions 1903 and 1909: December 10, 2019.” Once again, many folks saw that they were being offered the patch (although this time it apparently only went out to 1903 and 1909 Pro customers). Once again, the patch was offered repeatedly, even after it was installed properly. Once again, Microsoft yanked the patch, then updated the KB article to say:

This update was available through Windows Update. However, we have removed it because it was being offered incorrectly. When an organization registers or configures a device for Windows Autopilot deployment, the device setup automatically updates Windows Autopilot to the latest version.

Note There is no effect on Windows Autopilot being offered to Windows 10 devices. If you were offered this update and do not use Autopilot, installing this update will not affect you. Windows Autopilot update should not be offered to Windows 10 Home.

Those who cannot remember the past are condemned to repeat it.

Odd and sundry patches

In addition to the usual laundry list of patches, we also saw:

A new Malicious Software Removal Tool. Folks who downloaded the patches early may have missed it, because MS didn’t push it until several hours after the initial patching payload.

Updates for .Net Framework 3.5.x, 4.6.x, 4.7.x, 4.8 and more. Dozens of them. Martin Brinkmann has the full list on ghacks.net.

As well as the usual assortment of Office security patches.

There are new Servicing Stack Updates for Server 2008 and Server 2012, with manual download links as usual in ADV990001. If you don’t know about Servicing Stack Updates, don’t sweat it.

The easily dismissed Win7 End of life nag

December’s Windows 7/Server 2008 R2 Monthly Rollup brings a full-screen nag for upgrading to Windows 10, due to appear starting on January 15. Here’s what Microsoft says:

IMPORTANT Starting on January 15, 2020, a full-screen notification will appear that describes the risk of continuing to use Windows 7 Service Pack 1 after it reaches end of support on January 14, 2020. The notification will remain on the screen until you interact with it. This notification will only appear on the following editions of Windows 7 Service Pack 1:

Note The notification will not appear on domain-joined machines or machines in kiosk mode.

The Security-only patch, KB 4530692, includes the nag, which is embodied in the program EOSNotify.exe. Apparently the nag will only appear once, take up the whole screen and, once you’ve dismissed it, never return again. You’ll be forgiven if you recall similar promises during the “Get Windows 10” GWX campaign.

For those of you who can’t be bothered to dismiss the nag screen (or worry that it won’t go away as easily as Microsoft says), you can set this registry key:


To have the value “DiscontinueEOS”=dword:00000001

We’ll be covering that nag and its aftereffects extensively as details unfold. Remember that more than a quarter of all Windows users are on Win7.

Watch the bugs come out of the, uh, woodwork on AskWoody.

Copyright © 2019 IDG Communications, Inc.

Source link

Time-Machine Tuesday: A non-smashing success

This IT pilot fish works in a big open-plan office, where the last employee out is supposed to turn off the lights.

One day, the last person is someone who’s never before been the last to leave, and she can’t find the light switch. She does find a big handle marked “power,” so she flips that.

Naturally, all the lights go off, along with everything else. But she heads home having done her duty.

Do you feel as if you’ve heard this story before? You might have, but we promise you that this ends up differently from most “somebody went and hit the big red button” stories.

Next morning, no one can get in. The electric lock on the front door to the office isn’t working.

To read this article in full, please click here

Source link