Newsletter Archives

• Microsoft re-releases buggy July .NET Security Only patches

  Posted on October 13, 2020 at 21:17 CDT by woody • Comment in the Forums

  Microsoft just announced that it has re-issued the buggy July .NET Security Only patches identified as CVE–2020-1147, and covering a gazillion different KBs. Okay, I overspoke. Maybe half a gazillion.

  The bug? Ahem:

  After you apply this update, some applications experience a TypeInitializationException exception when they try to deserialize System.Data.DataSet or System.Data.DataTable instances from the XML within a SQL CLR stored procedure.

  You had to ask.

  Anyway, if you see a .NET patch from July suddenly appear in October, you need to install it, and now you know why.

  UPDATE: @PKCano has the gory details – including KB numbers for the re-released Security Only patches for Win7 and Server 2008 R2 – posted here.

  Windows Patches/Security .NET patches, CVE–2020-1147, July 2020 Black Tuesday, October 2020 Black Tuesday

• MS-DEFCON 3: There are some oddities, but it’s time to install the July 2020 patches

  Posted on July 31, 2020 at 10:23 CDT by woody • Comment in the Forums

  Looks like Microsoft’s fixed the bugs that it introduced this month. It’s time to get the July patches installed.

  There’s one potential oddity — you may get the .NET Framework Preview installed on Windows 10 version 1903 or 1909 — but I don’t see any reported bugs in that (unwanted!) patch.

  Step-by-step details in Computerworld Woody on Windows.

  Windows Patches/Security July 2020 Black Tuesday, MS-DEFCON 3

• Where we stand with the July 2020 patches

  Posted on July 30, 2020 at 13:23 CDT by woody • Comment in the Forums

  Patching bugs this month ran quite the gamut, from a buggy patch for paying Win7 customers to a “move fast and break things” server bug in Outlook.

  The situation with the “optional, non-security, C/D Week” patches seems murky as ever.

  Details in Computerworld Woody on Windows.

  Windows Patches/Security July 2020 Black Tuesday

• Windows Update’s bifurcated mess

  Posted on July 24, 2020 at 10:27 CDT by woody • Comment in the Forums

  

  Now we know why this week’s Preview patches behave so strangely.

  Details in Computerworld Woody on Windows. Thx, @abbodi86!

  Windows Patches/Security July 2020 Black Tuesday, Preview

• Microsoft releases some “optional, non-security C/D Week” patches. Avoid them.

  Posted on July 22, 2020 at 08:14 CDT by woody • Comment in the Forums

  The folks at MS have decided that we’re no longer in a “public health situation” that’s worthy of a moratorium on useless, error-prone patches. Late yesterday they pushed out a bunch of them.

  You may see Cumulative Update Previews offered for Win10 versions 1909, 1903, 1809, or Server 2019. (They don’t appear on my machines just yet, and there is no Preview so far for 2004.)

  You will see a Cumulative Update Preview for .NET, various versions.

  Don’t click to Download and install for any of them. You don’t want them.

  Full story in Computerworld Woody on Windows.

  Windows Patches/Security July 2020 Black Tuesday

• Bad Office Click-to-Run (and installed MSI version?) update blamed for Outlook freeze

  Posted on July 15, 2020 at 12:24 CDT by woody • Comment in the Forums

  Lots of reports this morning about Outlook freezing on start.

  From an anonymous poster on AskWoody:

  Today when I went to check my email, Outlook would not open; it would load the “Starting Outlook…” splash screen, which would close without opening the Outlook window itself, and the taskbar icon went away. Looking in Reliability History, it states that Outlook has crashed.

  I tried opening in safe mode (it does the exact same process as described above) and restarting the computer to no avail. I even tried the full repair (not the quick one), redownloading and reactivating MS Office 2019, but no go.

  Quintalis on Reddit:

  Outlook immediately crashing on open after patching last night

  Even in safe mode, appcrash. Full online repair no good, rolling back updates, anyone seeing this?

  edit: appcrash, exception code 0xc0000005, re-install no good, rollback no good. We also regedited for sigred mitigation last night, I’m tempted to temporarily undo that and test…

  edit2: temporarily unpatched sigred, tested, not the culprit!

  edit3: Had some copies of Office 2019 C2R lying around, installed version 1808 (Build 10363.20015 Click-to-run) and it’s working. Yay?

  From tenebrousrogue:

  I’ve got a fix, after this hit several of our clients. Performing a rollback fixed it, must be a bad office update. open cmd, run:

  cd “\Program Files\Common Files\microsoft shared\ClickToRun”

  then:

  officec2rclient.exe /update user updatetoversion=16.0.6366.2062

  EDIT: u/peEtr had success as well, with a more recent version (June24th). Change the second command to:

  officec2rclient.exe /update user updatetoversion=16.0.12827.20470

  Additional reports (1, 2, 3)

  UPDATE: From @rpodric

  I assumed the update they were talking about was server side, since I’ve been on the same C2R (Beta) build for a week, but who knows. Nothing should have changed build-wise here. My third attempt running it this morning was successful somehow.

  In the past few minutes, Microsoft has acknowledged the bug, but you’re on your own. “As a workaround, users can utilize Outlook on the web or their mobile clients.” Golly. My PC doesn’t work for email, so I need to whip out my iPad?

  ANOTHER UPDATE: Microsoft says “We’re rolling out a fix for this issue, and we expect the mitigation to reach all customers over the next few hours.” No details about version numbers – or even the method being used to roll out the fix.

  Says Ralph Carothers: “So, by reach them do you mean its going to back door patch them? Because this happened middle of the day to most of the users I’ve had impacted, and I certainly didn’t push out a patch.”

  Office Patches/Security July 2020 Black Tuesday, Office Click-to-Run

• FAQ: The Windows DNS Server security hole, CVE-2020-1350, from a “normal” user’s perspective

  Posted on July 15, 2020 at 05:41 CDT by woody • Comment in the Forums

  You’re going to see a lot of sand flying about a Windows security hole that was plugged yesterday. Here’s what most people need to know about CVE-2020-1350, also known as SIGRed:

  Q: Do I need to be worried about it?

  A: Unless you’re in charge of a Windows DNS Server, no.

  Q: How do I know if I’m in charge of a Windows DNS Server?

  A: If you had to ask the question, you aren’t.

  Q: If I am in charge of a Windows DNS Server, should I be concerned?

  A: Yes. You need to get the latest Server cumulative update installed.

  Q: What if all of my Windows DNS Servers are internal only?

  A: You need to get patched anyway. It’s likely easier to exploit the hole on a publicly-facing Windows DNS Server, but internal servers aren’t immune. Marcus Hutchins says:

  Can affect Windows Servers that expose DNS externally, or can be triggered by getting a user to visit a malicious website using IE or pre-Chromium Edge… While technically wormable, it seems unlikely. A more likely scenario would be ransomware actors using it to gain a access to the Domain Controller, then pushing ransomware to all network clients.

  Q: Is it really that serious?

  A: Yep, it’s a significant security hole that’s been around for at least 17 years. Several people have remarked that variations on the exploit have existed for a decade. Good advice from @SwiftOnSecurity:

  Microsoft has issued an unusual private push alert to Premier customers under NDA about CVE-2020-1350. Patch or apply workaround now. Note workaround requires DNS service restart do not just hand this to admins. I do NOT trust the registry key workaround. Its effect is not auditable and provable. Apply the patch. Something this big with no signs of current exploit means Microsoft went through in-depth testing to prove it out before telling the world. Apply patch and validate and deploy it now.

  Q: Should we bend over and kiss our cumulative keesters goodbye?

  A. Depends on your keester, I guess. We’ll see an active exploit soon, but not right away. Per Kevin Beaumont:

  I don’t expect a quick turnaround to RCE in public, the discoverers didn’t reach it, it requires time and skill… after every big RCE vulnerability announcement, Twitter becomes ‘this would take 5 minutes to write an exploit for!’ Then rarely anybody writes a public RCE exploit quickly, unless it’s a GET web request. If there’s some degree of skill required, a barrier.

  For 99.9% of you, there’s nothing to be concerned about. For the other 0.1%, it’s showtime.

  There’s a technical description from Sagi Tzadik on the Check Point Research web site.

  Windows Patches/Security CVE-2020-1350, July 2020 Black Tuesday

• July 2020 Patch Tuesday

  Posted on July 14, 2020 at 12:09 CDT by woody • Comment in the Forums

  Here’s what we know about this month’s Patch Tuesday crop.

  Big news: There’s a bug in Windows DNS Server that’s a “wormable” Remote Code Execution vulnerability, with a CVSS score of 10.0 – as high as it gets. If you’re running a Windows DNS Server, you need to install CVE-2020-1350, even if it’s buggy. There’s a registry change that’ll subvert the bug.

  Win10 Patch Tuesday cumulative updates –

  • Version 1903 and 1909 – KB 4565483 – Fixes the long-standing LSASS bug
  • Version 2004 – KB 4565503 – Fixes the OneDrive app bug, in addition to the LSASS bug.

  Dustin Childs’ analysis on the Zero Day Initiative blog is up:

  • Fixes for 123 individually identified security holes (CVEs), “That makes five straight months of 110+ CVEs released and brings the total for 2020 up to 742. “
  • “None of these bugs are listed as being under attack at the time of release, while one CVE is listed as publicly known.”

  In addition, Childs has a reinforcement of the DNS Server bug, “The attack vector requires very large DNS packets, so attacks cannot be conducted over UDP. Considering Windows DNS servers are usually also Domain Controllers, definitely get this patched as soon as you can.” The bug is known as SigRed, and apparently has been around for 17 years, according to Hackernews.

  New Servicing Stack Updates for Win10:

  • Versions 1903, 1909, KB 4565554
  • Version 2004, KB 4566785

  Martin Brinkmann has his usual thorough list on ghacks.net.

  Windows Patches/Security CVE-2020-1350, July 2020 Black Tuesday
• « Older Entries