Posts Tagged


Take your time, get it right for March Patch Tuesday

This is a big update to the Windows platform for the Microsoft March Patch Tuesday release cycle. Consisting of 115 patches, mostly to the Windows desktop, with almost all of the critical issues relating to browser-based scripting engine memory issues, this will be a difficult set of updates to release and manage.

The testing profile for the Windows desktop platform is very large, with a lower than usual exploitability/risk rating. For this month, we do not have any reports of publicly exploited or disclosed vulnerabilities (zero-days), so my recommendation is to take your time, test the changes to each platform, create a staged rollout plan and wait for future (potentially) imminent changes from Microsoft.

Known issues

Each month, Microsoft includes a list of known issues that relate to the operating system and platforms that are included in this update cycle. I have referenced a few key issues that relate to the latest builds from Microsoft including:

  • When using Windows Server containers with the March 10, 2020 updates, you might encounter issues with 32-bit applications and processes. For important guidance on updating Windows containers, please see Windows container version compatibility.
  • After installing KB4493509, devices with some Asian language packs installed may receive the error, “0x800f0982 – PSFX_E_MATCHING_COMPONENT_NOT_FOUND.”
  • CVE-2020-0903 | Microsoft Exchange Server Spoofing Vulnerability: When you try to manually install this security update by double-clicking the update file (.msp) to run it in Normal mode (that is, not as an administrator), some files are not correctly updated.
  • Internet Explorer: After installing this update and restarting your device, you might receive the error, “Failure to configure Windows updates. Reverting Changes. Do not turn off your computer” and the update might show as Failed in Update History. Please see KB4497181.

And on Windows 7.x, 8.x and Server 2012 builds you will still see the following (outstanding) known issues:

  • Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).” This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

Microsoft is working on a resolution and will provide an update in an upcoming release.

Major revisions

There have been numerous updates to the Microsoft LDAP Channel binding and signing advisory over the past year. Microsoft has recently posted a new update that includes:

“Microsoft is announcing that the March 10, 2020 security updates are available that add options for administrators to harden the configurations for LDAP channel binding on Active Directory domain controllers. Further information and configuration options can be found here: ADV190023. While the latest servicing stack information can be found here (ADV990001).”

The following Remote Desktop vulnerabilities have now been updated to include all versions of Windows 10:

No further action for all of these major revisions is required if you are using Microsoft automatic updates.

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

  • Browsers (Microsoft IE and Edge)
  • Microsoft Windows (both desktop and server)
  • Microsoft Office (Including Web Apps and Exchange)
  • Microsoft Development platforms (ASP.NET Core, .NET Core and Chakra Core)
  • Adobe Flash Player


It’s not you, it’s your browser. With 15 critical updates and one remaining patch rated as important by Microsoft, the majority of critical vulnerabilities addressed in this month’s Patch Tuesday relate to browser-based scripting Engines (Chakra, JavaScript). Though all of the critical rated patches could lead to remote code execution scenarios, their CVSS scores and thus their corresponding exploitability are quite low (average 4.4 out 10).

Further narrowing the security concerns for these reported vulnerabilities is that they only apply to relatively few Windows builds. If you are on the latest release of Windows 10, you are probably OK. If you are on an old version of Windows (pre-Chakra), you are not affected. If you are running a really early version of Windows 10 (who are you?), then you have a problem. Add these browser patches to your standard rollout schedule.

Microsoft Windows

With 73 updates (of which 6 are rated as critical), this month’s Windows update covers a lot of functionality across the Windows ecosystem, including changes to: Microsoft Scripting Engine, Windows App Platform and Frameworks, Windows Media, Windows Silicon Platform, Microsoft Edge, Internet Explorer, Windows Fundamentals, Windows Authentication, Windows Kernel, Windows Core Networking, Windows Storage and File Systems, Windows Peripherals, Windows Update Stack, and Windows Server.

Some areas of concern include LNK file handling changes (CVE-2020-0684), updates to the Microsoft graphics core engine (GDI) and a slew of patches to the Windows media engine (CVE-2020-0801, CVE-2020-0807, CVE-2020-0809, CVE-2020-0869).

Aside from the documented security issues, I feel that this month we are at risk of some patch deployment challenges. This month’s Patch Tuesday is a large update that covers a lot of “functional territory.” This means a lot of testing will be required across core Windows functionality and application dependencies.

Working through the patch manifest and update payloads, there are some core files that have been updated that have caused application issues in the past. One good example includes the file MSXML3R.DLL, which was updated in CVE-2020-0844. We have already encountered a number of potential issues in the following applications as part of our algorithmic analysis, including:

  • WinZip 18.5
  • VMWare Workstation Professional
  • NV/HPE Controller
  • Siebel Tools 8.1.x

Our advice this month is to take your time with this update, create a staged rollout (IT first) and then deploy in concentric rings of business priority.

We also expect some out-of-band updates later this month — possibly with an update to the LNK patches or the SMB issue. For further guidance on the potential issues with the latest SMB vulnerability, Microsoft has released an advisory here: ADV200005.

Editor’s note: Microsoft released KB4551762 on March 12 to address the SMBv3 vulnerability.

Microsoft Office

This month Microsoft Office has one critical patch in Word (CVE-2020-0852) with eight other vulnerabilities rated as important by Microsoft. The Word-related vulnerability addresses a memory issue and could lead to a remote code execution scenario; it is relatively difficult to exploit. Add these updates to your regular patch cadence office.

Microsoft Development Platforms

For March Microsoft has released five patches for its development platform, all rated as important by Microsoft. Mostly affecting the Azure DevOps server, they are (currently) difficult to exploit and lead only to spoofing and elevation of privilege attacks. Add these minor updates to your standard development update effort.

Adobe Flash Player

Adobe has chosen not to release any updates for this March Patch Tuesday cycle. Unfortunately, this does not mean that there are no vulnerabilities to exploit this month. Expect an update from Adobe next week or shortly after. Until then, it’s Margarita time!

Copyright © 2020 IDG Communications, Inc.

Source link

Disappearing SMBv3 patch, non-security Office patches, and a so-far-mild Patch Tuesday

It’s been almost 24 hours since this month’s Patch Tuesday patches rolled out. The good news: Almost everybody patching individual machines reports smooth sailing.

That’s remarkable, given the host of problems with last month’s disappearing icons (temporary profile) bug and the unending litany of complaints about the last “optional, non-security, C/D Week” patch. As best I can tell, none of those problems have been officially acknowledged, and if they’re still in evidence with yesterday’s patches, people aren’t complaining about them. Yet.

To be sure, we’re still seeing the usual problems with installing the patches — Error  0x800f0900 seems particularly prolific on Reddit — but at this early juncture, I don’t see any debilitating problems.

That may well change. Many patchers have other problems on their minds and the day is still young.

Duplicated updates

I’ve seen numerous reports of duplicated updates in Windows Update lists, specifically for Windows 8.1, a .Net Quality Rollup, and the Server 2012 R2 Monthly Rollup. Seeing the same, identical patch listed twice in an update list does not inspire confidence. 

It looks like Microsoft tidied up the list overnight. At this point there are 110 “2020-03” entries in the Microsoft Update Catalog — which is to say, 110 individual patches — three fewer than there were last night.

Less is better, yes?

Extra Office updates

It looks as if Microsoft took advantage of Patch Tuesday to release additional non-security patches for Office. Usually the non-security Office patches come out on the first Tuesday of the month, but this announcement contains links to all of these new Office non-security patches:

Excel 2016

March 10, 2020, update for Excel 2016 (KB4011130)

Office 2016

March 3, 2020, update for Office 2016 (KB4484247)

Office 2016

March 10, 2020, update for Office 2016 (KB3213653)

Outlook 2016

March 10, 2020, update for Outlook 2016 (KB4462111)

PowerPoint 2016

March 10, 2020, update for PowerPoint 2016 (KB3085405)

Project 2016

March 10, 2020, update for Project 2016 (KB3085454)

Skype for Business 2016

March 3, 2020, update for Skype for Business 2016 (KB4484245)

Skype for Business 2015 (Lync 2013)

March 3, 2020, update for Skype for Business 2015 (Lync 2013) (KB4484097)

Office 2016 Language Interface Pack

March 3, 2020, update for Office 2016 Language Interface Pack (KB4484136)

Remarkably, those patches are not listed in the official Latest non-security updates for versions of Office that use Windows Installer (MSI) post.

The strange case of CVE-2020-0796 ‘CoronaBlue’ 

Yet another patch timing mishap: The SMBv3 patch described in Microsoft Security Advisory ADV200005 | Microsoft Guidance for Disabling SMBv3 Compression has been causing all sorts of consternation among admins in charge of networks running SMBv3. 

Long story short, Microsoft apparently had the patch ready to go but pulled it at the last minute. Microsoft warned security software manufacturers in advance that the patch was coming (a common practice), but didn’t yell, “Stop the presses!” in time to keep the cows in the barn. Two organizations on the inside accidentally published, then pulled, descriptions. The story raced through the blogosphere.

The hole is wormable in that it might be able to propagate without any human interaction. “Might” being the operable term: A potential exploit faces formidable challenges.

At first, Microsoft didn’t officially announce the hole, and didn’t post a fix. Then, its hand having been forced, on Tuesday night, Microsoft posted the Security Advisory, which says:

Microsoft is aware of a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client.

At this point, it appears that only Server 2013 and 2019 are affected. Microsoft has a manual workaround. There aren’t any known exploits but Catalin Cimpanu at ZDNet just tweeted:

I have now seen/talked to 3 different people claiming they found the bug in less than 5 minutes. I won’t be surprised if exploits pop up online by the end of the day.

If you’re in charge of a network running SMBv3, you can catch up on the developments by reading Satnam Narang on Tenable, Sergiu Gatlan at BleepingComputer, Catalin Cimpanu at ZDNet and, in the past couple of hours, Dan Goodin at Ars Technica. There’s an active discussion on AskWoody. You should also follow @msftsecresponse on Twitter.

If you aren’t running a network with SMBv3, you can chill. There’s nothing in this month’s patches that need concern you right now.

We’re kickin’ butt and naming names on AskWoody.

Copyright © 2020 IDG Communications, Inc.

Source link

Time-Machine Tuesday: For better or worse

It’s years ago, and this young PC tech pilot fish is hired by a school district — and his co-workers warn him that the principal of one of the schools they’ve given him is very difficult to get along with.

On the day he’s paged to go to that school and to see that principal, fish has a knot in his stomach. But upon arriving, he finds is a flustered middle-aged woman who immediately begins griping about “these new computers” and how she doesn’t have time for these problems because she’s getting married.

Fish calmly comments, “Getting married? That’s great!”

Principal stops complaining for a moment and says, “Yes, it’s exciting” — and then begins complaining again that she can’t get the reports she needs to do her job.

To read this article in full, please click here

Source link

A large – but manageable – February Patch Tuesday brings critical browser updates

With 99 reported vulnerabilities and patches to both Microsoft browsers, Office and Windows, this month’s Patch Tuesday update is not as large an administrative burden as you might initially think. We’ve rated the browser updates as a “Patch Now” update due to issues with the Chakra engine, but both Office and Windows can be scheduled according to a regular patch cadence. Unfortunately, we have another Adobe Flash update to deploy, but no critical development updates for February.

You can find more information in our helpful infographic here.

Known issues

Each month, Microsoft includes a list of known issues that relate to the operating system and platforms included in this update cycle. I have referenced a few key issues that relate to the latest builds from Microsoft including:

  • Microsoft Cluster Shared Volumes (CSV) can still generate the error message,” “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).” Microsoft is still working on a solution. Until a fix is released, you can try the operation as an administrator or try to “own” directories in question before the operation.
  • After installing some Asian language packs you may still (see KB4493509) receive the error, “0x800f0982 – PSFX_E_MATCHING_COMPONENT_NOT_FOUND.”

Microsoft has been working on a fix for both these issues for a while now; we don’t expect a resolution any time soon.

Major revisions

This month, two CVEs have undergone a major revision increment:

  • CVE-2019-1332: CVE information revised to announce the availability of Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (CU) and Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR).
  • CVE-2019-8267: Microsoft revised this to include Internet Explorer 11 installed on all supported editions of Windows 10 Version 1809, Windows Server 2019, Windows 10 Version 1903, and Windows 10 Version 1909 because they are affected by this vulnerability. This change may affect your server update cycle

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

  • Browsers (Microsoft IE and Edge)
  • Microsoft Windows (both desktop and server)
  • Microsoft Office (Including Web Apps and Exchange)
  • Microsoft Development platforms ( ASP.NET Core, .NET Core and Chakra Core)
  • Cloud and Devices
  • Adobe Flash Player (to be discontinued)


Microsoft has released nine updates to both browsers (Internet Explorer and Edge) this month, with five rated as critical, two as moderate and the remaining two as important. The biggest concerns are the four critical updates to the Chakra core scripting engine that could lead to remote code execution.

Microsoft advises that these four critical vulnerabilities could lead to a scenario where “An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”

Add this update to your “Patch Now” schedule.

Microsoft Windows

Ok, this may sound like a lot of updates: Microsoft has released 79 patches to the Windows desktop and server ecosystem. Five of these updates are rated as critical and the rest are all rated as important by Microsoft. It sounds (and feels) like a lot of patches, but other than the critical updates to the Remote Desktop (RDP) platform, the administrative burden is not that great.

This patch cycle feels more like an administrative cycle than that one that addresses critical or exploited vulnerabilities. It’s “clean-up” time for Microsoft after the Christmas break and a very light January patch cycle.

Add these updates to your standard release schedule. 

Microsoft Office

Microsoft has released six updates to Microsoft Office – all rated as important. The most serious for this month affects Microsoft Excel with a potential (but difficult-to-exploit) remote code execution scenario involving how Excel handles objects in memory. All of this month’s reported vulnerabilities require access to the target system and require users to take explicit action on vulnerable systems. There is an update this month to Microsoft SharePoint server which will require a reboot of all affected servers.

Add these Office patches to your regularly scheduled updates

Microsoft development platforms

This month, Microsoft has not released any updates to the many variations of .NET, but we do have one update to SQL Server that has been rated as important. CVE-2020-0618 is relatively difficult to exploit, as it requires access to the SQL server instance and requires specially crafted pages sent to the SQL Server Reporting services.

Add this update to your regularly scheduled patch release cadences.

Cloud and Devices

We have allocated this space to the recent cloud (Azure) and device updates from Microsoft. This month, Microsoft has not released any Azure related patches, but has published a Microsoft Surface (device level) patch (CVE-2020-0702) that has been rated as important (and difficult to exploit).

Add this device related update to your regular patch cycle.

Adobe Flash Player

I thought that we were done with critical Adobe Flash Player updates from Microsoft. I even instructed our development team to remove this section from our internal bulletins. Well, they (Flash Player) updates are back, with a vengeance.

This month, we see another ActiveX flaw in Flash Player (ADV20003/CVE-2020-3757) that could lead to the execution of arbitrary code on the compromised computer. According to the Adobe security bulletin, “The vulnerability exists due to a type confusion error when processing Flash content. A remote attacker can create a specially crafted .SWF file, trick the victim into playing it, trigger a type confusion error and execute arbitrary code on the target system. Successful exploitation of this vulnerability may result in complete compromise of the target system.”

Microsoft has documented a potential work-around relating to the Flash ActiveX control which includes making the following registry changes:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{D27CDB6E-AE6D-11CF-96B8-444553540000}]

“Compatibility Flags”=dword:00000400

[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftInternet ExplorerActiveX Compatibility{D27CDB6E-AE6D-11CF-96B8-444553540000}]

“Compatibility Flags”=dword:00000400

Add this update to your “Patch Now” release schedule.

Copyright © 2020 IDG Communications, Inc.

Source link

Patch Tuesday: 99 holes, ‘exploited’ IE fix, Win7 mayhem and UEFI ghost

What a month it’s been – and the Patch Tuesday patches have only been out for 24 hours. There are many February patching foibles to report.

Every version of Windows 10, stretching back to the beginning of time (except for the long-neglected version 1511) got patches this month.

Welcome to the new, improved, paid-for Win7 patches

There was no free Windows 7 update this month, even though Microsoft released a Monthly Rollup Preview in January. Anyone concerned about the well-documented “Stretch” black wallpaper bug caused by last month’s Win7 Monthly Rollup apparently can pound sand – or manually download and install the fix. Your choice.

It looks as if Microsoft has repaired the part of the KB 4539602 manual patch that was deleting boot files, although the official explanation  (SHA-2 enablement) still doesn’t make sense to me. 

Those of you who paid for Win7 Extended Security Updates have these patches on offer (Thx, RDRguy.) :

  • 2020-02 Security Monthly Quality Rollup for Windows 7 (KB4537820)
  • 2020-02 Security Only Quality Update for Windows 7 (KB4537813)
  • 2020-02 Cumulative Security Update for Internet Explorer 11 for Windows 7 (KB4537767) 

Two problems. First, you’ll only see those updates if you first install the patch Microsoft released yesterday:

  • 2020-02 Extended Security Updates (ESU) Licensing Preparation Package for Windows 7 (KB4538483)

Second, you won’t be able to see them until you get January Servicing Stack Update installed, KB 4536952. Many folks report that they were never offered the January SSU – remember you have to completely clear out the patch backlog before Windows Update will even show you an SSU. Alternatively, you can download and install it manually. Sound familiar?

Once you have the January Servicing Stack Update installed and the next for-pay patches appear, you should also get

  • 2020-02 Servicing Stack Update for Windows 7 (KB4537829)

Of course, we haven’t had enough time to test any of the patches, so it’s best to wait. Who knows? Maybe Microsoft will have another surprise pre-patch patch waiting.

By the way…, it looks as if Microsoft has backtracked on another part of its Windows 7 end-of-life saber rattling: I’m seeing many reports that Win7 machines are getting the latest Malicious Software Removal Tool, even though MSRT updates were supposed to expire last month.

Another big, bad, horrible sky-is-falling ‘exploited’ IE bug

Let’s hear it for the “you better patch now or else, bucko” contingent. This month, the patching blogosphere is alight with dire warnings about the security hole CVE-2020-0674, yet another IE/JScript “Scripting Engine Memory Corruption Vulnerability.” 

This time, we’re all supposed to get the January patches installed RIGHT NOW because this horrible hole has already been exploited. Yeah, sure. 

We’ve heard that tune before, most recently last month when the Chicken Littles (and the U.S. National Security Agency) said the sky was falling because of the horrendous Crypt32.dll security hole, known as “Chain Of Fools” or “CurveBall.” That one fizzled out, too, in spite of the government-funded hype. I don’t know of any widespread CurveBall attacks – not yet, anyway.

Think you need to fix CVE-2020-0674 right away? Consider. The new, new IE/JScript “exploited” security hole is so threatening and ominous that Microsoft itself held back on releasing the fix. Microsoft first warned us of the security hole on Jan. 17 in Security Advisory ADV200001, which included a manual workaround (disabling JScript). It didn’t release a fix until yesterday. If Microsoft could wait a few weeks to release the patch, my guess is that you can handily wait a few weeks to install the patch.

Oh. If you followed the ADV200001 advice and manually disabled JScript, you have to manually re-enable it before installing this month’s patch. Joke’s on you.

0patch problems

Many of us are hoping that the micro-patching company 0patch will be able to plug the security holes in Win7, without paying for (or hassling with) Microsoft’s Extended Support Updates. As of this writing, 0patch has issued a fix for the “exploited” Internet Explorer JScript bug, but I haven’t yet heard of a fix for all of the other ESU-related patches.

There’s a problem in paradise, though. In some cases, Firefox can crash on start if you have 0patch installed – there’s a conflict between Firefox 73 and the 0patch agent. Mitja Kolsek has a workaround posted on the 0patch blog.

The UEFI mystery of KB 4524244

Microsoft seems to have a specific UEFI manufacturer in its sites. KB 4524244, the “Security update for Windows 10, version 1607, 1703, 1709, 1803, 1809, and 1903: February 11, 2020” is being offered, independently of the usual Cumulative Updates, on all versions of Windows 10. 

By the way, if you think Win10 version 1909 was immune from the KB 4524244 malaise, think again. Microsoft forgot to include 1909 on its master list, but KB 4524244 is included in the 1909 MS Update Catalog listing and in the WSUS listing. (Thx, PKCano.) The KB article – even its title – is clearly wrong.

Here’s what’s odd about that patch, aside from the fact that it isn’t bundled with the cumulative updates. Microsoft is targeting one specific UEFI supplier:

Addresses an issue in which a third-party Unified Extensible Firmware Interface (UEFI) boot manager might expose UEFI-enabled computers to a security vulnerability.

I don’t know which UEFI boot manager has been singled out for this extraordinary treatment, but if you know, I’d sure appreciate a hint on

The patch isn’t without its hazard. From LordDeath86, on Reddit: “After installing the update for 1909 I got a new pending security update KB 4524244 and it always fails with error 0x800f0922. And again Google and Bing are failing me here because that error code can mean anything from bad VPN software (don’t have any) to a too small system partition (also not the case here) to a bad star constellation that sends cosmic rays into my PC and let the update fail.”

We’re only starting to collect and collate the problems with this month’s patches. If you have a tale to tell – or a question – hit us on

Copyright © 2020 IDG Communications, Inc.

Source link