Microsoft Patch Day News Roundup August 2019 (Updated)

*UPDATES
*Microsoft: These Windows 10 updates fix broken Visual Basic apps but not for 1903
https://www.zdnet.com/article/microsoft-these-windows-10-updates-fix-broken-visual-basic-apps-but-not-for-1903/

*Microsoft releases patches to fix the VB/VBA/VBScript bugs
https://www.askwoody.com/2019/microsoft-releases-patches-to-fix-the-vb-vba-vbscript-bugs/

*More fixes for the VB/VBA/VBScript bugs in this month’s patches
https://www.askwoody.com/2019/more-fixes-for-the-vb-vba-vbscript-bugs-in-this-months-patches/

August 2019 Security Updates
https://msrc-blog.microsoft.com/2019/08/13/august-2019-security-updates/
https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/312890cc-3673-e911-a991-000d3a33a34d

Vulnerability in Microsoft CTF protocol goes back to Windows XP
https://www.zdnet.com/article/vulnerability-in-microsoft-ctf-protocol-goes-back-to-windows-xp/

August 2019 Microsoft Patch Tuesday
https://isc.sans.edu/forums/diary/August+2019+Microsoft+Patch+Tuesday/25236/

August 2019 Security patches: It’s a biiiiiiiiig month
https://www.askwoody.com/2019/august-2019-security-patches-its-a-biiiiiiiiig-month/

Microsoft warns of two new ‘wormable’ flaws in Windows Remote Desktop Services
https://www.zdnet.com/article/microsoft-warns-of-two-new-wormable-flaws-in-windows-remote-desktop-services/

August Patch Tuesday: Update Fixes ‘Wormable’ Flaws in Remote Desktop Services, VBScript Gets Disabled by Default
https://blog.trendmicro.com/trendlabs-security-intelligence/august-patch-tuesday-update-fixes-wormable-flaws-remote-desktop-services-vbscript-disabled-by-default/

To patch Windows or not: Do you want BlueKeep bug or broken Visual Basic apps?
https://www.zdnet.com/article/to-patch-windows-or-not-do-you-want-bluekeep-bug-or-broken-visual-basic-apps/

Do you want to protect yourself against BlueKeep, or break Visual Basic?
https://www.askwoody.com/2019/do-you-want-to-protect-yourself-against-bluekeep-or-break-visual-basic/

Microsoft quietly updates all of this month’s Windows patches warning about conflicts with Visual Basic 6, VBA and VBScript
https://www.askwoody.com/2019/microsoft-quietly-updates-all-of-this-months-windows-patches-warning-about-conflicts-with-visual-basic-6-vba-and-vbscript/

August 2019 Updates: Issues with VB6, VBA and VBScript
https://borncity.com/win/2019/08/15/august-2019-updates-issues-with-vb6-vba-and-vbscript/

The sky is not falling: DejaBlue (aka BlueKeep II, III, IV, V) are not being exploited in the wild
https://www.askwoody.com/2019/the-sky-is-not-falling-dejablue-aka-bluekeep-ii-iii-iv-v-are-not-being-exploited-in-the-wild/

Microsoft Patch Day News Roundup August 2019

August 2019 Security Updates
https://msrc-blog.microsoft.com/2019/08/13/august-2019-security-updates/
https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/312890cc-3673-e911-a991-000d3a33a34d

Vulnerability in Microsoft CTF protocol goes back to Windows XP
https://www.zdnet.com/article/vulnerability-in-microsoft-ctf-protocol-goes-back-to-windows-xp/

August 2019 Microsoft Patch Tuesday
https://isc.sans.edu/forums/diary/August+2019+Microsoft+Patch+Tuesday/25236/

August 2019 Security patches: It’s a biiiiiiiiig month
https://www.askwoody.com/2019/august-2019-security-patches-its-a-biiiiiiiiig-month/

Microsoft warns of two new ‘wormable’ flaws in Windows Remote Desktop Services
https://www.zdnet.com/article/microsoft-warns-of-two-new-wormable-flaws-in-windows-remote-desktop-services/

August Patch Tuesday: Update Fixes ‘Wormable’ Flaws in Remote Desktop Services, VBScript Gets Disabled by Default
https://blog.trendmicro.com/trendlabs-security-intelligence/august-patch-tuesday-update-fixes-wormable-flaws-remote-desktop-services-vbscript-disabled-by-default/

To patch Windows or not: Do you want BlueKeep bug or broken Visual Basic apps?
https://www.zdnet.com/article/to-patch-windows-or-not-do-you-want-bluekeep-bug-or-broken-visual-basic-apps/

Do you want to protect yourself against BlueKeep, or break Visual Basic?
https://www.askwoody.com/2019/do-you-want-to-protect-yourself-against-bluekeep-or-break-visual-basic/

Microsoft quietly updates all of this month’s Windows patches warning about conflicts with Visual Basic 6, VBA and VBScript
https://www.askwoody.com/2019/microsoft-quietly-updates-all-of-this-months-windows-patches-warning-about-conflicts-with-visual-basic-6-vba-and-vbscript/

August 2019 Updates: Issues with VB6, VBA and VBScript
https://borncity.com/win/2019/08/15/august-2019-updates-issues-with-vb6-vba-and-vbscript/

The sky is not falling: DejaBlue (aka BlueKeep II, III, IV, V) are not being exploited in the wild
https://www.askwoody.com/2019/the-sky-is-not-falling-dejablue-aka-bluekeep-ii-iii-iv-v-are-not-being-exploited-in-the-wild/

What are Microsoft’s Definitions of Mainstream and Extended Support?

January 14th, 2020 is a big day for IT professionals that follow Microsoft operating systems in the enterprise. On that date, the following products will go out of Extended Support:

  • Windows 7 (SP1)
  • Windows Server 2008 (SP2)
  • Windows Server 2008 R2 (SP1)

What does this mean exactly?

Microsoft has a Lifecycle Policy that are guidelines for the availability of support throughout the life of a product. It is broken down into two categories:

To answer our question on Mainstream and Extended Support, we examine the recently renamed Fixed Policy.

The Fixed Lifecycle Policy applies to many products currently available through retail purchase or volume licensing and offers a minimum of:

10 years of support (a minimum of five years Mainstream Support followed by five years Extended Support) at the supported service pack level for business, developer, and desktop operating system products. To be eligible for support, customers may be required to deploy the latest update. See the Lifecycle product search for specific details. Some products may offer less than 10 years of support. See this article for exceptions.

Five years of Mainstream Support at the supported service pack level for consumer and multimedia products.

This information gets us closer to the heart of the matter, as Mainstream and Extended Support are defined later down that page.  At the time of this writing, Microsoft defined them like this:

Mainstream Support

Mainstream Support is the first phase of the product lifecycle. At the supported service pack level, Mainstream Support for products and services includes*:

Incident support (no-charge incident support, paid incident support, support charged on an hourly basis, support for warranty claims)

Security update support

The ability to request non-security updates

NOTE: Incident support benefits included with license, licensing programs (such as Software Assurance or Visual Studio subscriptions) or other no-charge support programs are only available during the Mainstream Support phase.

Extended Support

The Extended Support phase follows Mainstream Support. At the supported service pack level, Extended Support includes:

Paid support

Security updates at no additional cost

Ability to request non-security fixes for select products, for eligible Unified Support customers.5

NOTE:

Microsoft will not accept requests for warranty support, design changes, or new features during the Extended Support phase.

Extended Support is not available for consumer, consumer hardware, or multimedia products.

Enrollment in a paid support program may be required to receive these benefits for certain products.

Service Packs are Important

Now there is a critical phrase in those statements that needs attention. That is “At the supported service pack level”

As well as Microsoft’s Lifecycle Policy, there is also a Service Pack Lifecycle Policy that you must consider when you are keeping track of what is supported. That policy states:

Service Pack Policy

When a new service pack is released, Microsoft provides either 12 or 24 months of support for the previous service pack, varying according to the product family (for example, Windows, Office, Servers, or Developer tools).

When support for a service pack ends, Microsoft no longer provides new security updates, DST updates, or other nonsecurity updates for that service pack. Commercially reasonable support will continue to be available, as described in the following.

When support for a product ends, support of all the service packs for that product also ends. The product’s lifecycle supersedes the service pack policy.

Support timelines for service packs remains consistent within the product family.

Microsoft publishes specific support timelines for a previous service pack when the new service pack is released. 

For example, Windows 7 SP1 is in Extended Support until January 20th, 2020, but Windows 7 RTM is not.  In a nutshell, this means that Microsoft will require you to install at least SP1 to a Windows 7 RTM system before provides support.

Microsoft recommends staying on a fully supported service pack to ensure they are on the latest and most secure version of their product.

For customers on supported products with service pack versions that have left full support, Microsoft offers commercially reasonable support as follows:

Commercially reasonable support incidents will be provided through Microsoft Customer Service and Support and Microsoft managed support offerings (such as Premier Support). If the support incident requires escalation to development for further guidance, requires a nonsecurity update, or requires a security update, customers will be asked to upgrade to a fully supported service pack.

Commercially reasonable support does not include an option to engage Microsoft product development resources; technical workarounds may be limited or not possible.

For more information on Microsoft’s Lifecycle Policy, see its website for details:https://support.microsoft.com/en-us/hub/4095338/microsoft-lifecycle-policy

What is supported by Microsoft? ConfigMgr Edition – July 29th, 2019

With the release of update 1906 for System Center Configuration Manager (ConfigMgr) current branch, its time too do a checkup of your ConfigMgr environment and see if it is still supported by Microsoft.

What does that mean exactly?

As it states in the ConfigMgr documentation, there are two servicing phases for current branch support.

Security and Critical Updates servicing phase – When running the latest current branch version of Configuration Manager, you receive both Security and Critical Updates.

Security Updates (Only) servicing phase – After the release of a new current branch version, Microsoft only supports security updates to older versions for the remainder of that version’s support lifecycle

With the release of Current Branch (CB) version 1906, what versions of ConfigMgr are still supported?

As of this writing, CB version 1802 is the minimum version that you have to be on to be in the Security Updates (only) phase, while 1806 is the minimum version to still be on the Security and Critical Updates servicing phase. The 1802 version end of support date is September 22, 2019, so if you are still on that version, you should be already planning an upgrade to get current.

To keep ahead of these updates, refer to this statement from the Microsoft Documentation:

The latest current branch version is always in the Security and Critical Updates servicing phase. This support statement means that if you encounter a code defect that warrants a critical update, you must have the latest current branch version installed to receive a fix. All other supported current branch versions are eligible to receive only security updates.

All support ends after the 18-month lifecycle has expired for a current branch version.

Update your Configuration Manager environment to the latest version before support for your current version expires.”

Any other version is now almost out of support completely (yes that means any version of SCCM 2012 correction, SCCM 2012 with Service packs are in extended support until July, 22nd 2022), so if you are one of those earlier version numbers you should get the upgrade going ASAP. If you are not sure what version you are on, you can check in the console by going to “About System Center Configuration Manager” an at the top left corner the dialog displays the site and console versions.

As it says in the documentation, note that the console version is slightly different from the site version. The minor version of the console corresponds to the Configuration Manager release version. For example, in Configuration Manager version 1802 the initial site version is 5.0.8634.1000, and the initial console version is 5.1802.1082.1700. The build (1082) and revision (1700) numbers may change with future hotfixes.

If you need to upgrade from SCCM 2012, then you should use the latest baseline version (currently version 1902) and then upgrade to the next version via the console.

If you are planning on installing ConfigMgr from scratch (like in the lab or a brand new site hierarchy), you should also use the latest baseline version and upgrade as needed with in-console updates.

For more detailed information on versions of ConfigMgr CB, baseline versions, and what you can do to upgrade your site if you are behind, you can check these links for details.

Support for Configuration Manager current branch versions
https://docs.microsoft.com/en-us/sccm/core/servers/manage/current-branch-versions-supported

Version details
https://docs.microsoft.com/en-us/sccm/core/servers/manage/updates#version-details

Baseline and update versions
https://docs.microsoft.com/en-us/sccm/core/servers/manage/updates#bkmk_Baselines

Microsoft Patch Day News Roundup July, 2019 (7/11/2019)

July 2019 Security Update Release: https://msrc-blog.microsoft.com/2019/07/09/july-2019-security-update-release/
July 2019 Patch Tuesday has arrived: https://www.askwoody.com/2019/july-2019-patch-tuesday-has-arrived/
MSFT July 2019 Patch Tuesday: https://isc.sans.edu/diary/25110
July’s Patch Tuesday Fixes Critical Flaws in Microsoft Edge and Internet Explorer, Including 2 Exploited Vulnerabilities: https://blog.trendmicro.com/trendlabs-security-intelligence/julys-patch-tuesday-fixes-critical-flaws-in-microsoft-edge-and-internet-explorer-including-windows-dhcp-server/
Patch Tuesday Lowdown, July 2019 Edition: https://krebsonsecurity.com/2019/07/patch-tuesday-lowdown-july-2019-edition/
Microsoft surreptitiously adds telemetry functionality to July 2019 Win7 Security-only patch: https://www.askwoody.com/2019/microsoft-surreptitiously-adds-telemetry-functionality-to-july-2019-win7-security-only-patch/
New Windows 7 ‘security-only’ update installs telemetry/snooping, uh, feature: https://www.computerworld.com/article/3408496/new-windows-7-security-only-update-installs-telemetrysnooping-uh-feature.html
Microsoft stirs suspicions by adding telemetry files to security-only update : https://www.zdnet.com/article/microsoft-stirs-suspicions-by-adding-telemetry-files-to-security-only-update/
Windows 7’s July 2019 Security Patch Includes Telemetry: https://www.howtogeek.com/428265/windows-7s-july-2019-security-patch-includes-telemetry/
Microsoft to Windows 10 users: Patch Secure Boot now against ‘critical’ bug: https://www.zdnet.com/article/microsoft-to-windows-10-users-patch-secure-boot-now-against-critical-bug/
Microsoft July 2019 Patch Tuesday fixes zero-day exploited by Russian hackers: https://www.zdnet.com/article/microsoft-july-2019-patch-tuesday-fixes-zero-day-exploited-by-russian-hackers/