• February 2018 Security Patches Are Out

    The Microsoft Software Update Services pages have finally been updated. With 34 new patches listed – first update since January 9th in spite of the patches, re-patches, and re-re patches.

    Due to issues with some anti-virus software and the Meltdown/Spectre fixes last month, the ALLOW REGKEY must be set in the Registry by the AV software to enable downloads through Windows Update.

    Martin Brinkman has posted his usual thorough overview on ghacks.net.

    Operating System Distribution

    • Windows 7: 15 vulnerabilities of which 1 is rated critical and 14 are rated important
    • Windows 8.1: 12 vulnerabilities of which 1 is rated critical, 10 are important, and 1 is moderate
    • Windows 10 version 1607: 17 vulnerabilities of which 1 is rated critical and 16 are rated important
    • Windows 10 version 1703: 18 vulnerabilities of which 1 is rated critical and 17 are rated important
    • Windows 10 version 1709: 19 vulnerabilities of which 1 is rated critical and 18 are rated important

    Windows Server products

    • Windows Server 2008: 11 vulnerabilities of which 1 is rated critical and 10 are rated important
    • Windows Server 2008 R2: 14 vulnerabilities of which 1 is rated critical and 13 are rated important
    • Windows Server 2012 and 2012 R2: 12 vulnerabilities of which 1 is rated critical 11 are rated important
    • Windows Server 2016: 17 vulnerabilities of which 1 is rated critical and 16 are rated important

    Other Microsoft Products

    • Internet Explorer 11: 2 vulnerabilities, 1 critical, 1 important
    • Microsoft Edge: 14 vulnerabilities, 11 critical, 2 important, 1 moderate

    KB article 4077965 lists Office Security and non-security updates:
    Office 2016 – 13
    Office 2013 – 8
    Office 2010 – 5
    Office 2007 – 2
    SharePoint and SharePoint Servers – 8
    Many of these have fixes for remote code execution vulnerabilities.

    If last month’s updates are any example, it is a good idea to backup your system before installing these updates – after we reach DEFCON-3 or above later this month, of course.