Newsletter Archives

• Microsoft: New non-security updates prevent attack on Win10 Servers running IIS — but there are no instructions

  Posted on February 21, 2019 at 07:51 CST by woody • Comment in the Forums

  Now you know why I’m skeptical of the “optional non-security” description about the second monthly Win10 cumulative updates.

  Ends up that the patches are not “optional” (click Check for updates and see what happens) and, at least this month, for Servers running IIS, they’re not “non-security.”

  Case in point: Microsoft Security Advisory ADV190005 | Guidance to adjust HTTP/2 SETTINGS frames, released yesterday. From the Advisory:

  Microsoft is aware of a potential condition which can be triggered when malicious HTTP/2 requests are sent to a Windows Server running Internet Information Services (IIS). This could temporarily cause the system CPU usage to spike to 100% until the malicious connections are killed by IIS.

  The HTTP/2 specification allows clients to specify any number of SETTINGS frames with any number of SETTINGS parameters. In some situations, excessive settings can cause services to become unstable and may result in a temporary CPU usage spike until the connection timeout is reached and the connection is closed.

  To address this issue, Microsoft has added the ability to define thresholds on the number of HTTP/2 SETTINGS included in a request. These thresholds must be defined by the IIS administrator, they are not preset by Microsoft.

  The solution? Install this month’s second set of cumulative updates — the ones released earlier this week, KB 4487006, KB 4487011, KB 4487021, KB 4487029 — and then follow these instructions:

  Customers should review Knowledge Base Article 4491420 and take appropriate action.

  Except, well, golly, there is no KB 4491420.

  UPDATE: Microsoft published the instructions, Define thresholds on the number of HTTP/2 Settings parameters exchanged over a connection.

  Windows Patches/Security IIS DoS, KB 4487006, KB 4487011, KB 4487021, KB 4487029, KB 4491420

• Microsoft pushes odd third-Tuesday cumulative updates for Win10 1803, 1709, 1703 and 1607 – but not for 1809

  Posted on February 20, 2019 at 06:31 CST by woody • Comment in the Forums

  I think this is good news.

  Yesterday Microsoft published cumulative updates for the older versions of Windows 10, but didn’t release one for the latest, version 1809. I take that as a good sign — perhaps Microsoft is letting its 1809 patches bake a little longer.

  Moral of the story: Don’t click Check for Updates!

  Details in Computerworld Woody on Windows.

  UPDATE

  We also have:

  KB 4487016 – Preview of the Win8.1 March Monthly Rollup

  KB 4486565– Preview of the Win7 March Monthly Rollup

  The Microsoft Update Catalog also shows that several of this month’s Win10 Cumulative Updates were re-issued. Not sure what’s up with that, but it usually means there was a change in the metadata — which means it changes the installation logic.

  ANOTHER UPDATE

  Now at least one of the Knowledge Base articles is being changed to say that yesterday’s non-security updates do NOT fix the acknowledged bug:

  • After installing this update, some users cannot pin a web link on the Start menu or the taskbar.
  Windows Patches/Security KB 4487006, KB 4487011, KB 4487021, KB 4487029