MS-DEFCON 2: Batten down the hatches for August

Topic

New Reply

ISSUE 20.31.1 • 2023-08-03 By Susan Bradley I’ve been tracking some side effects that Microsoft has yet to acknowledge. With Patch Tuesday just around
[See the full post at: MS-DEFCON 2: Batten down the hatches for August]

Susan Bradley Patch Lady/Prudent patcher

7 users thanked author for this post.

AlphaCharlie, windbg, JCpharm, Casey S, DLivesInTexas, abbodi86, lmacri

Reply | Quote

Replies

Susan Bradley wrote:

Most of the issues I’m tracking won’t be seen by consumers, only businesses. Many of them are in Windows 11 22H2. So even though I’ve approved 22H2 for everyone but gamers (my approval based primarily on the near impossibility of purchasing anything but 22H2), there are still some issues that businesses will find annoying. For the most part, these are described in Microsoft’s support post KB5028254 (OS Build 22621.2070) Preview. Here are two examples.

This update addresses an issue that affects certain display and audio devices. They are missing after your system resumes from sleep.

Sleep has been a slightly annoying issue with various versions of Windows, and 11 22H2 is no different. It appears that Microsoft is once again trying to quash the remaining bugs.

This update addresses an issue that affects virtual private networks (VPN). There might be excessive Address Resolution Protocol (ARP) requests to the network gateway. This occurs when the VPN is on a wireless mesh network that uses an aggressive throttling algorithm. Because of this, network performance is poor.

What’s interesting about this bug is that it specifically calls out MESH technology as causing a side effect unique to that platform. Note that I’m still hearing reports that users are seeing some issues with LT2P with IPSec. Again, bugs with that platform are still being quashed.

Both of those “example issues” are also addressed in KB5028245 (OS Build 22000.2245) Preview for Windows 11 21H2.

Why single out just Windows 11 22H2 for criticism?

Reply | Quote

Because Microsoft is touting it as the platform to be on and we only have Sept and October before 21H2 is retired. These business bugs should be gone by now.

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

DLivesInTexas

Reply | Quote

Susan Bradley wrote:

Business users

We are now in August and still do not have a clue about when Microsoft will be enforcing CVE-2023-32019. Worse, I have no idea what side effects I might see once we’ve applied the registry fixes explained by Microsoft in KB5028407: How to manage the vulnerability associated with CVE-2023-32019. I find it inexcusable and disturbing that no details have been posted.

What impacts did your testing reveal over the last seven weeks?

Susan Bradley wrote:

Manual registry keys have to be deployed to be fully patched. Testing the impact and will report back.

Reply | Quote

I don’t know what to look for.  Their lack of communication on this and on several other issues lately is inexcusable.

Their cloud security is also getting complaints of a lack of communication and transparency:

Microsoft comes under blistering criticism for “grossly irresponsible” security | Ars Technica

“What you hear from Microsoft is ‘just trust us,’ but what you get back is very little transparency and a culture of toxic obfuscation.”

Susan Bradley Patch Lady/Prudent patcher

4 users thanked author for this post.

Alex5723, AWRobClark, windbg, DLivesInTexas

Reply | Quote