Microsoft Patch Day News Roundup August 2019 (Updated)

*UPDATES
*Microsoft: These Windows 10 updates fix broken Visual Basic apps but not for 1903
https://www.zdnet.com/article/microsoft-these-windows-10-updates-fix-broken-visual-basic-apps-but-not-for-1903/

*Microsoft releases patches to fix the VB/VBA/VBScript bugs
https://www.askwoody.com/2019/microsoft-releases-patches-to-fix-the-vb-vba-vbscript-bugs/

*More fixes for the VB/VBA/VBScript bugs in this month’s patches
https://www.askwoody.com/2019/more-fixes-for-the-vb-vba-vbscript-bugs-in-this-months-patches/

August 2019 Security Updates
https://msrc-blog.microsoft.com/2019/08/13/august-2019-security-updates/
https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/312890cc-3673-e911-a991-000d3a33a34d

Vulnerability in Microsoft CTF protocol goes back to Windows XP
https://www.zdnet.com/article/vulnerability-in-microsoft-ctf-protocol-goes-back-to-windows-xp/

August 2019 Microsoft Patch Tuesday
https://isc.sans.edu/forums/diary/August+2019+Microsoft+Patch+Tuesday/25236/

August 2019 Security patches: It’s a biiiiiiiiig month
https://www.askwoody.com/2019/august-2019-security-patches-its-a-biiiiiiiiig-month/

Microsoft warns of two new ‘wormable’ flaws in Windows Remote Desktop Services
https://www.zdnet.com/article/microsoft-warns-of-two-new-wormable-flaws-in-windows-remote-desktop-services/

August Patch Tuesday: Update Fixes ‘Wormable’ Flaws in Remote Desktop Services, VBScript Gets Disabled by Default
https://blog.trendmicro.com/trendlabs-security-intelligence/august-patch-tuesday-update-fixes-wormable-flaws-remote-desktop-services-vbscript-disabled-by-default/

To patch Windows or not: Do you want BlueKeep bug or broken Visual Basic apps?
https://www.zdnet.com/article/to-patch-windows-or-not-do-you-want-bluekeep-bug-or-broken-visual-basic-apps/

Do you want to protect yourself against BlueKeep, or break Visual Basic?
https://www.askwoody.com/2019/do-you-want-to-protect-yourself-against-bluekeep-or-break-visual-basic/

Microsoft quietly updates all of this month’s Windows patches warning about conflicts with Visual Basic 6, VBA and VBScript
https://www.askwoody.com/2019/microsoft-quietly-updates-all-of-this-months-windows-patches-warning-about-conflicts-with-visual-basic-6-vba-and-vbscript/

August 2019 Updates: Issues with VB6, VBA and VBScript
https://borncity.com/win/2019/08/15/august-2019-updates-issues-with-vb6-vba-and-vbscript/

The sky is not falling: DejaBlue (aka BlueKeep II, III, IV, V) are not being exploited in the wild
https://www.askwoody.com/2019/the-sky-is-not-falling-dejablue-aka-bluekeep-ii-iii-iv-v-are-not-being-exploited-in-the-wild/

Microsoft Patch Day News Roundup August 2019

August 2019 Security Updates
https://msrc-blog.microsoft.com/2019/08/13/august-2019-security-updates/
https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/312890cc-3673-e911-a991-000d3a33a34d

Vulnerability in Microsoft CTF protocol goes back to Windows XP
https://www.zdnet.com/article/vulnerability-in-microsoft-ctf-protocol-goes-back-to-windows-xp/

August 2019 Microsoft Patch Tuesday
https://isc.sans.edu/forums/diary/August+2019+Microsoft+Patch+Tuesday/25236/

August 2019 Security patches: It’s a biiiiiiiiig month
https://www.askwoody.com/2019/august-2019-security-patches-its-a-biiiiiiiiig-month/

Microsoft warns of two new ‘wormable’ flaws in Windows Remote Desktop Services
https://www.zdnet.com/article/microsoft-warns-of-two-new-wormable-flaws-in-windows-remote-desktop-services/

August Patch Tuesday: Update Fixes ‘Wormable’ Flaws in Remote Desktop Services, VBScript Gets Disabled by Default
https://blog.trendmicro.com/trendlabs-security-intelligence/august-patch-tuesday-update-fixes-wormable-flaws-remote-desktop-services-vbscript-disabled-by-default/

To patch Windows or not: Do you want BlueKeep bug or broken Visual Basic apps?
https://www.zdnet.com/article/to-patch-windows-or-not-do-you-want-bluekeep-bug-or-broken-visual-basic-apps/

Do you want to protect yourself against BlueKeep, or break Visual Basic?
https://www.askwoody.com/2019/do-you-want-to-protect-yourself-against-bluekeep-or-break-visual-basic/

Microsoft quietly updates all of this month’s Windows patches warning about conflicts with Visual Basic 6, VBA and VBScript
https://www.askwoody.com/2019/microsoft-quietly-updates-all-of-this-months-windows-patches-warning-about-conflicts-with-visual-basic-6-vba-and-vbscript/

August 2019 Updates: Issues with VB6, VBA and VBScript
https://borncity.com/win/2019/08/15/august-2019-updates-issues-with-vb6-vba-and-vbscript/

The sky is not falling: DejaBlue (aka BlueKeep II, III, IV, V) are not being exploited in the wild
https://www.askwoody.com/2019/the-sky-is-not-falling-dejablue-aka-bluekeep-ii-iii-iv-v-are-not-being-exploited-in-the-wild/

What are Microsoft’s Definitions of Mainstream and Extended Support?

January 14th, 2020 is a big day for IT professionals that follow Microsoft operating systems in the enterprise. On that date, the following products will go out of Extended Support:

  • Windows 7 (SP1)
  • Windows Server 2008 (SP2)
  • Windows Server 2008 R2 (SP1)

What does this mean exactly?

Microsoft has a Lifecycle Policy that are guidelines for the availability of support throughout the life of a product. It is broken down into two categories:

To answer our question on Mainstream and Extended Support, we examine the recently renamed Fixed Policy.

The Fixed Lifecycle Policy applies to many products currently available through retail purchase or volume licensing and offers a minimum of:

10 years of support (a minimum of five years Mainstream Support followed by five years Extended Support) at the supported service pack level for business, developer, and desktop operating system products. To be eligible for support, customers may be required to deploy the latest update. See the Lifecycle product search for specific details. Some products may offer less than 10 years of support. See this article for exceptions.

Five years of Mainstream Support at the supported service pack level for consumer and multimedia products.

This information gets us closer to the heart of the matter, as Mainstream and Extended Support are defined later down that page.  At the time of this writing, Microsoft defined them like this:

Mainstream Support

Mainstream Support is the first phase of the product lifecycle. At the supported service pack level, Mainstream Support for products and services includes*:

Incident support (no-charge incident support, paid incident support, support charged on an hourly basis, support for warranty claims)

Security update support

The ability to request non-security updates

NOTE: Incident support benefits included with license, licensing programs (such as Software Assurance or Visual Studio subscriptions) or other no-charge support programs are only available during the Mainstream Support phase.

Extended Support

The Extended Support phase follows Mainstream Support. At the supported service pack level, Extended Support includes:

Paid support

Security updates at no additional cost

Ability to request non-security fixes for select products, for eligible Unified Support customers.5

NOTE:

Microsoft will not accept requests for warranty support, design changes, or new features during the Extended Support phase.

Extended Support is not available for consumer, consumer hardware, or multimedia products.

Enrollment in a paid support program may be required to receive these benefits for certain products.

Service Packs are Important

Now there is a critical phrase in those statements that needs attention. That is “At the supported service pack level”

As well as Microsoft’s Lifecycle Policy, there is also a Service Pack Lifecycle Policy that you must consider when you are keeping track of what is supported. That policy states:

Service Pack Policy

When a new service pack is released, Microsoft provides either 12 or 24 months of support for the previous service pack, varying according to the product family (for example, Windows, Office, Servers, or Developer tools).

When support for a service pack ends, Microsoft no longer provides new security updates, DST updates, or other nonsecurity updates for that service pack. Commercially reasonable support will continue to be available, as described in the following.

When support for a product ends, support of all the service packs for that product also ends. The product’s lifecycle supersedes the service pack policy.

Support timelines for service packs remains consistent within the product family.

Microsoft publishes specific support timelines for a previous service pack when the new service pack is released. 

For example, Windows 7 SP1 is in Extended Support until January 20th, 2020, but Windows 7 RTM is not.  In a nutshell, this means that Microsoft will require you to install at least SP1 to a Windows 7 RTM system before provides support.

Microsoft recommends staying on a fully supported service pack to ensure they are on the latest and most secure version of their product.

For customers on supported products with service pack versions that have left full support, Microsoft offers commercially reasonable support as follows:

Commercially reasonable support incidents will be provided through Microsoft Customer Service and Support and Microsoft managed support offerings (such as Premier Support). If the support incident requires escalation to development for further guidance, requires a nonsecurity update, or requires a security update, customers will be asked to upgrade to a fully supported service pack.

Commercially reasonable support does not include an option to engage Microsoft product development resources; technical workarounds may be limited or not possible.

For more information on Microsoft’s Lifecycle Policy, see its website for details:https://support.microsoft.com/en-us/hub/4095338/microsoft-lifecycle-policy

Microsoft Patch Day News Roundup July, 2019 (7/11/2019)

July 2019 Security Update Release: https://msrc-blog.microsoft.com/2019/07/09/july-2019-security-update-release/
July 2019 Patch Tuesday has arrived: https://www.askwoody.com/2019/july-2019-patch-tuesday-has-arrived/
MSFT July 2019 Patch Tuesday: https://isc.sans.edu/diary/25110
July’s Patch Tuesday Fixes Critical Flaws in Microsoft Edge and Internet Explorer, Including 2 Exploited Vulnerabilities: https://blog.trendmicro.com/trendlabs-security-intelligence/julys-patch-tuesday-fixes-critical-flaws-in-microsoft-edge-and-internet-explorer-including-windows-dhcp-server/
Patch Tuesday Lowdown, July 2019 Edition: https://krebsonsecurity.com/2019/07/patch-tuesday-lowdown-july-2019-edition/
Microsoft surreptitiously adds telemetry functionality to July 2019 Win7 Security-only patch: https://www.askwoody.com/2019/microsoft-surreptitiously-adds-telemetry-functionality-to-july-2019-win7-security-only-patch/
New Windows 7 ‘security-only’ update installs telemetry/snooping, uh, feature: https://www.computerworld.com/article/3408496/new-windows-7-security-only-update-installs-telemetrysnooping-uh-feature.html
Microsoft stirs suspicions by adding telemetry files to security-only update : https://www.zdnet.com/article/microsoft-stirs-suspicions-by-adding-telemetry-files-to-security-only-update/
Windows 7’s July 2019 Security Patch Includes Telemetry: https://www.howtogeek.com/428265/windows-7s-july-2019-security-patch-includes-telemetry/
Microsoft to Windows 10 users: Patch Secure Boot now against ‘critical’ bug: https://www.zdnet.com/article/microsoft-to-windows-10-users-patch-secure-boot-now-against-critical-bug/
Microsoft July 2019 Patch Tuesday fixes zero-day exploited by Russian hackers: https://www.zdnet.com/article/microsoft-july-2019-patch-tuesday-fixes-zero-day-exploited-by-russian-hackers/

ISC Diary | The Zero-Day Pendulum Swings

Thanks to some readers Ken and Paul, we’ve been supplied with some Zero-Day reading.   The best I can skim in short notice on these stories that developed yesterday is that Microsoft is looking into claims of an IE 8 vulnerability. [1]    IE 6,7,9,10 are claimed to be unaffected.

 

I suggest the pendulum analogy because one article cites a US Government website was hacked [2] by way of a ‘watering hole’ attack to exploit [3] with what is now believed to be ‘zero-day’ but was originally thought to be exploited by a slightly modifed version of a well known trojan named ‘Poison-Ivy’.[4]

 

Too many links, too little time.  There is a lot of good reading out there right now, leaving much to review as this issue develops.   So please share your comments and knowledge on this issue with us and our community as it develops.

 

[1] http://technet.microsoft.com/en-us/security/advisory/2847140
[
2] http://labs.alienvault.com/labs/index.php/2013/u-s-department-of-labor-website-hacked-and-redirecting-to-malicious-code/
[
3] http://arstechnica.com/security/2013/05/internet-explorer-zero-day-exploit-targets-nuclear-weapons-researchers/
[
4] http://www.invincea.com/2013/05/part-2-us-dept-labor-watering-hole-pushing-poison-ivy-via-ie8-zero-day/
-Kevin

ISC Handler on Duty

ISC Diary | The Zero-Day Pendulum Swings.