Microsoft & Non-Microsoft Patch Tuesday – May 2017

Microsoft Patch Tuesday

Microsoft Patch Tuesday released and has 56 CVE’s for the May 2017 which includes 15 CVEs rated “Critical”, 40 CVE’s rated “Important” and one rated “Moderate”. These updates affect software and services like Internet Explorer, Microsoft Edge Browser, Microsoft Windows, Microsoft Office and Microsoft Office Services and Web Apps,.NET Framework, Adobe Flash Player.

Summary :

  • No more Windows Vista patches.
  • Last few Windows 10 RTM release updates, Microsoft won’t be supported any more updates onwards.
  • Updates were released for all supported client and server versions of Windows.
  • Other Microsoft products with patches are Internet Explorer, Microsoft Edge, Microsoft Office, the Microsoft NET Framework, and Adobe Flash Player.

Microsoft also published Security Advisory 4010323 which says they will now deprecate SSL\TLS for IE11 and Edge Browser will no longer load sites with such certificates, you should upgrade from SHA-1 to SHA-2 to avoid warning messages and get the full-fledged use of it.

Microsoft Update: This change will only impact SHA-1 certificates that chain to a root in the Microsoft Trusted Root Program where the end-entity certificate or the issuing intermediate uses SHA-1. Enterprise or self-signed SHA-1 certificates will not be impacted, although we recommend that all customers quickly migrate to SHA-2 based certificates.

Security Update List

Cumulative Update for Windows 10 Version 1703 (KB4016871)
Cumulative Update for Windows 10 Version 1607 and Windows Server 2016 (KB4019472)
Cumulative Update for Windows 10 Version 1511 (KB4019473)
Cumulative Update for Windows 10 (KB4019474)
Security Update for Windows Server 2008 (KB4018196)
Cumulative Security Update for Internet Explorer (KB4018271)
Security Update for Windows Server 2008 and Windows XP Embedded (KB4018466)
Security Update for WES09 and POSReady 2009 (KB4018490)
Security Update for Windows Server 2008 and Windows XP Embedded (KB4018556)
Security Update for Windows Server 2008 (KB4018821)
Security Update for Windows Server 2008 (KB4018885)
Security Update for Windows Server 2008 (KB4018927)
May 2017 Security Only Update for.NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 on Windows Embedded Standard
7, Windows 7, and Windows Server 2008 R2 (KB4019108)
May 2017 Security Only Update for.NET Framework 2.0 on Windows Server 2008 (KB4019109)
May 2017 Security Only Update for.NET Framework 3.5, 4.5.2, 4.6, 4.6.1 on Windows Embedded 8 Standard and
Windows Server 2012 (KB4019110)
May 2017 Security Only Update for.NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2 on Windows 8.1 and Windows
Server 2012 R2 (KB4019111)
May 2017 Security and Quality Rollup for.NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 on Windows Embedded
Standard 7, Windows 7, and Windows Server 2008 R2 (KB4019112)
May 2017 Security and Quality Rollup for.NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2 on Windows Embedded 8
Standard and Windows Server 2012 (KB4019113)
May 2017 Security and Quality Rollup for.NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2 on Windows 8.1, Windows
RT 8.1, and Windows Server 2012 R2 (KB4019114)
May 2017 Security and Quality Rollup for.NET Framework 2.0 on Windows Server 2008 (KB4019115)
Security Update for Windows Server 2008 (KB4019149)
Security Update for Windows Server 2008 and Windows XP Embedded (KB4019204)
Security Update for WES09 and POSReady 2009 and Windows Server 2008 (KB4019206)
2017-05 Security Only Quality Update for Windows 8.1 and Windows Server 2012 R2 (KB4019213)
2017-05 Security Only Quality Update for Windows Embedded 8 Standard and Windows Server 2012 (KB4019214)
2017-05 Security Monthly Quality Rollup for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2
(KB4019215)
2017-05 Security Monthly Quality Rollup for Windows Embedded 8 Standard and Windows Server 2012 (KB4019216)
2017-05 Security Only Quality Update for Windows Embedded Standard 7, Windows 7, and Windows Server 2008 R2
(KB4019263)
2017-05 Security Monthly Quality Rollup for Windows Embedded Standard 7, Windows 7, and Windows Server 2008 R2
(KB4019264)
2017-05 Security Update for Adobe Flash Player for Windows 10, Windows 8.1, Windows RT 8.1, Windows Server
2012 R2, Windows Embedded 8 Standard, and Windows Server 2012 (KB4020821)

Non-Security Update List:

Update for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 (KB3173424)
Dynamic Update for Windows 10 Version 1703 (KB4020007)
Update for Windows 10 Version 1703 (KB4020008)
Update for Windows Server 2008 and Windows XP Embedded (KB4020535)
Windows Malicious Software Removal Tool – May 2017 (KB890830)

Adobe Patches:

Adobe has released small updates consist of 2 updates. The Critical Updates for flash fixes 7 CVEs (CVE-2017-3068, CVE-2017- 3069, CVE-2017-3070, CVE-2017-3071, CVE-2017-3072, CVE-2017-3073, CVE-2017-3074 ) and being listed as priority 1 and under active attack. It is highly recommended to fix all the updates as soon as possible. The other update Security updates for Adobe Experience Manager(AEM) and not being reported as under an active attack so far.

Intel Patches:

Recent few updates have been released from processor giant. There are two ways this vulnerability may be accessed.

1) An unprivileged network attacker could gain system privileges to provisioned Intel manageability.
2) An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability.

Critical severity rating CVE-2017-5689 allow an elevation of privilege vulnerability in AMT portion of the chipset. AMT provides managed client systems through the web interface, AMT is enabled in the BIOS but not provisioned. Neither remotely nor locally can be connected and nor the traffic ports 16992-16995 will be listening. And if you have enabled or using AMT then your system might be in a state of vulnerable.

Once configured, Intel AMT is a network service awaiting an authenticated and authorized request”. Traffic on ports 16992-16995 are directly intercepted by Intel AMT within the chipset before being passed to the host operating system… once Intel AMT is in a configured and accessible state.

Why Must Intel AMT Be Configured, and What is Required?

For more details visit here

Download Excel sheet: Security Update – MAY-2017

Intel Firmware Vulnerability

VulnerabilityIntel has released recommendations to address a vulnerability in the firmware of the following Intel products: Active Management Technology, Standard Manageability, and Small Business Technology firmware versions 6.x, 7.x, 8.x, 9.x, 10.x, 11.0, 11.5, and 11.6. This vulnerability does not affect Intel-based consumer PCs. An attacker could exploit this vulnerability to take control of an affected system.

Users and administrators are encouraged to review Intel Security Advisory INTEL-SA-00075 and updated mitigations and tools:

Users and administrators are encouraged to review Vulnerability Note VU#491375 and the Intel links below and refer to their original equipment manufacturers (OEMs) for mitigation strategies and updated firmware.

Note :  INTEL-SA-00075 Detection Guide , Detection Tool , Intel mitigation document 

References: 

https://www.us-cert.gov/ncas/current-activity/2017/05/07/Intel-Firmware-Vulnerability

https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr

https://www.kb.cert.org/vuls/id/491375

 

Internet Information Services (IIS) 6.0 Vulnerability for Windows Server 2003

Vulnerability US-CERT is aware of active exploitation of a vulnerability in Windows Server 2003 Operating System Internet Information Services (IIS) 6.0. Exploitation of this vulnerability may allow a remote attacker to take control of an affected system.

On June 15, 2015, Microsoft ended support for Windows Server 2003 Operating System, which includes its Internet Information Services (IIS) 6.0 web server. Computers running Windows Server 2003 Operating System and its associated programs will continue to work even after support ends. However, using unsupported software may increase the risks of viruses and other security threats.

US-CERT encourages users and administrators to review the National Vulnerability Database entry on this vulnerability, as well as US-CERT Alert TA14-310A.

For more details click here CVE-2017-7269.

Reference:  https://www.us-cert.gov/ncas/current-activity/2017/03/30/Internet-Information-Services-IIS-60-Vulnerability

Microsoft Patch Tuesday Mar-2017

Microsoft Patch Tuesday released and has 18 bulletins, nine has rated as critical as they allow remote code execution on affected machines. These updates affect IE, Edge, Hyper-V, SMB Server, Microsft Graphics Component.

Remote Code Execution Vulnerabilities allow an attacker to remotely execute commands on a machine and perform virtually any action on the vulnerable machine.

Lets see full list of important\critical updates below :

Microsoft Patch Tuesday  Updates:

RED CRITICAL                   BLUEIMPORTANT

1) MS17-006 Cumulative Security Update for Internet Explorer (4013073)

This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

2) MS17-007 Cumulative Security Update for Microsoft Edge (4013071)

This security update resolves vulnerabilities in Microsoft Edge. These vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited these vulnerabilities could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

3) MS17-008 Security Update for Windows Hyper-V (4013082)

This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an authenticated attacker on a guest operating system runs a specially crafted application that causes the Hyper-V host operating system to execute arbitrary code. Customers who have not enabled the Hyper-V role are not affected.

4) MS17-009 Security Update for Microsoft Windows PDF Library (4010319)

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user views specially crafted PDF content online or opens a specially crafted PDF document.

5) MS17-010 Security Update for Microsoft Windows SMB Server (4013389)

This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker sends specially crafted messages to a Microsoft Server Message Block 1.0 (SMBv1) server.

6) MS17-011 Security Update for Microsoft Uniscribe (4013076)

This security update resolves vulnerabilities in Windows Uniscribe. The most severe of these vulnerabilities could allow remote code execution if a user visits a specially crafted website or opens a specially crafted document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

7) MS17-012  Security Update for Microsoft Windows (4013078)

This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker runs a specially crafted application that connects to an iSNS Server and then issues malicious requests to the server.

8) MS17-013 Security Update for Microsoft Graphics Component (4013075)

This security update resolves vulnerabilities in Microsoft Windows, Microsoft Office, Skype for Business, Microsoft Lync, and Microsoft Silverlight. The most severe of these vulnerabilities could allow remote code execution if a user either visits a specially crafted website or opens a specially crafted document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

9) MS17-014 Security Update for Microsoft Office (4013241)

This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

10) MS17-015 Security Update for Microsoft Exchange Server (4013242)

This security update resolves a vulnerability in Microsoft Exchange Outlook Web Access (OWA). The vulnerability could allow remote code execution in Exchange Server if an attacker sends an email with a specially crafted attachment to a vulnerable Exchange server.

11) MS17-016 Security Update for Windows IIS (4013074)

This security update resolves a vulnerability in Microsoft Internet Information Services (IIS). The vulnerability could allow elevation of privilege if a user clicks a specially crafted URL which is hosted by an affected Microsoft IIS server. An attacker who successfully exploited this vulnerability could potentially execute scripts in the user’s browser to obtain information from web sessions.

12) MS17-017 Security Update for Windows Kernel (4013081)

This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker runs a specially crafted application.

13) MS17-018 Security Update for Windows Kernel-Mode Drivers (4013083)

This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application that could exploit the vulnerabilities and take control of an affected system.

14) MS17-019 Security Update for Active Directory Federation Services (4010320)

This security update resolves a vulnerability in Active Directory Federation Services (ADFS). The vulnerability could allow information disclosure if an attacker sends a specially crafted request to an ADFS server, allowing the attacker to read sensitive information about the target system.

15) MS17-020 Security Update for Windows DVD Maker (3208223)

This security update resolves an information disclosure vulnerability in Windows DVD Maker. The vulnerability could allow an attacker to obtain information to further compromise a target system.

16) MS17-021 Security Update for Windows DirectShow (4010318)

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow an information disclosure if Windows DirectShow opens specially crafted media content that is hosted on a malicious website. An attacker who successfully exploited the vulnerability could obtain information to further compromise a target system.

17) MS17-022 Security Update for Microsoft XML Core Services (4010321)

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow information disclosure if a user visits a malicious website. However, in all cases an attacker would have no way to force a user to click a specially crafted link. An attacker would have to convince a user to click the link, typically by way of an enticement in an email or Instant Messenger message.

18) MS17-023 Security Update for Adobe Flash Player

This security update resolves vulnerabilities in Adobe Flash Player when installed on all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows Server 2016.

Download Excel sheet: MS Patches – 2017(006-023)

Microsoft Patch Tuesday Delayed

Microsoft has delayed all the bulletins release which is scheduled for February month no updates are available at Microsoft Security Update Guide . Currently, we are not sure when Microsoft will release February patches.

Microsoft Updated: “UPDATE: 2/15/17: We will deliver updates as part of the planned March Update Tuesday, March 14, 2017

https://blogs.technet.microsoft.com/msrc/2017/02/14/february-2017-security-update-release/

Microsoft Security Update Guide (Portal)

Microsoft brings up with Security Update Guide Portal which is something cool and super exciting as this portal will make Patch Admin life much easier. When Microsoft release Patch Tuesday Patch Admin will follow Microsoft Security Bulletins to find out what all updates are released from the security bulletins site, Microsft didn’t have a common dashboard or portal to filter and sort them down based on Operating System and product.

Microsoft Security Bulletins.png

Monthly Patch List admins will compile to filter down patches based on Operating System and product.But using Security Update Guide portal things has become simpler and easier. From new portal we can:

  • Sort and filter security vulnerability and update content, for example, by CVE, KB number, product, or release date.
  • Filter out products that don’t apply to you, and drill down to more detailed security update information for products that do.
  • Leverage a new RESTful API to obtain Microsoft security update information. This eliminates the need for you to employ outdated methods like screen-scraping of security bulletin web pages to assemble working databases of necessary and actionable information.

portal

portal-1

Security Bulletins will be published till January 2017, from next month onwards we can find all the security updates information on the  Security Updates Portal.

 

Microsoft Patch Tuesday Jan-2017

Microsoft has released security & non-security updates for client and server version of Windows Operating System. Microsoft has released 4 security updates for January 2017, two bulletins are rated critical. It’s a good start for Patch Admins as MS has released only 4 updates and so far we haven’t heard any noise and issue with below all these updates.

Microsoft also released Windows 10 CU KB3213986, KB3210720, and KB3210721.

Microsoft Patch Tuesday Security Updates:

RED CRITICAL                   BLUEIMPORTANT

1) MS17-001 Security Update for Microsoft Edge (3214288) 

This security update resolves a vulnerability in Microsoft Edge. This vulnerability could allow an elevation of privilege if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited this vulnerability could gain elevated permissions on the namespace directory of a vulnerable system and gain elevated privileges.

2) MS17-002 Security Update for Microsoft Office (3214291)

This security update resolves a vulnerability in Microsoft Office. The vulnerability could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

3)MS17-003 Security Update for Adobe Flash Player (3214628)

This security update resolves vulnerabilities in Adobe Flash Player when installed on all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows Server 2016.

4) MS17-004 Security Update for Local Security Authority Subsystem Service (3216771)

A denial of service vulnerability exists in the way the Local Security Authority Subsystem Service (LSASS) handles authentication requests. An attacker who successfully exploited the vulnerability could cause a denial of service on the target system’s LSASS service, which triggers an automatic reboot of the system. The security update addresses the vulnerability by changing the way that LSASS handles specially crafted authentication requests.

Download Excel sheet : ms-patches-2017-001-004