by Mark | Feb 10, 2016 | How To, Patch Management, Patch Releases, SCCM
The following thirteen Patch Tuesday updates / patches have been released by Microsoft for the Febuary 2016 Update deployment.
Are you ready to start deploying and remove the patching risk using SnaPatch Patch Management Software?
MS16-009 – Critical
Cumulative Security Update for Internet Explorer (3134220)
This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
MS16-011- Critical
Cumulative Security Update for Microsoft Edge (3134225) This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS16-012 – Critical
Security Update for Microsoft Windows PDF Library to Address Remote Code Execution (3138938) This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if Microsoft Windows PDF Library improperly handles application programming interface (API) calls, which could allow an attacker to run arbitrary code on the user’s system. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. However, an attacker would have no way to force users to download or open a malicious PDF document.
MS16-013 – Critical
Security Update for Windows Journal to Address Remote Code Execution (3134811)
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a specially crafted Journal file. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
MS16-014 – Important
Security Update for Microsoft Windows to Address Remote Code Execution (3134228) This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker is able to log on to a target system and run a specially crafted application.
MS16-015 – Important
Security Update for Microsoft Office to Address Remote Code Execution (3134226) This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS16-016 – Important
Security Update for WebDAV to Address Elevation of Privilege (3136041) This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker uses the Microsoft Web Distributed Authoring and Versioning (WebDAV) client to send specifically crafted input to a server.
MS16-017 – Important
Security Update for Remote Desktop Display Driver to Address Elevation of Privilege (3134700)
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an authenticated attacker logs on to the target system using RDP and sends specially crafted data over the connection. By default, RDP is not enabled on any Windows operating system. Systems that do not have RDP enabled are not at risk.
MS16-018 – Important
Security Update for Windows Kernel-Mode Drivers to Address Elevation of Privilege (3136082)
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application.
MS16-019 – Important
Security Update for .NET Framework to Address Denial of Service (3137893) This security update resolves vulnerabilities in Microsoft .NET Framework. The more severe of the vulnerabilities could cause denial of service if an attacker inserts specially crafted XSLT into a client-side XML web part, causing the server to recursively compile XSLT transforms..
MS16-020 – Important
Security Update for Active Directory Federation Services to Address Denial of Service (3134222)
This security update resolves a vulnerability in Active Directory Federation Services (ADFS). The vulnerability could allow denial of service if an attacker sends certain input data during forms-based authentication to an ADFS server, causing the server to become nonresponsive.
MS16-021 – Important
Security Update for NPS RADIUS Server to Address Denial of Service (3133043)
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could cause denial of service on a Network Policy Server (NPS) if an attacker sends specially crafted username strings to the NPS, which could prevent RADIUS authentication on the NPS.
MS16-022 – Important
Security Update for Adobe Flash Player (3135782) This security update resolves vulnerabilities in Adobe Flash Player when installed on all supported editions of Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10.
by Mark | Jan 13, 2016 | Features, Patch Management, Patch Releases, SCCM
Microsoft’s January 2016 Patch Releases
The following nine Patch Tuesday updates / patches have been released by Microsoft for the January 2016 Update deployment.
MS16-001 – Critical
Cumulative Security Update for Internet Explorer (3124903)
This security update resolves vulnerabilities in Internet Explorer. The more severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
MS16-002- Critical
Cumulative Security Update for Microsoft Edge (3124904)
This security update resolves vulnerabilities in Microsoft Edge. The vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS16-003 – Critical
Cumulative Security Update for JScript and VBScript to Address Remote Code Execution (3125540)
This security update resolves a vulnerability in the VBScript scripting engine in Microsoft Windows. The vulnerability could allow remote code execution if a user visits a specially crafted website. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
MS16-004 – Critical
Security Update for Microsoft Office to Address Remote Code Execution (3124585)
This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS16-005 – Critical
Security Update for Windows Kernel-Mode Drivers to Address Remote Code Execution (3124584)
This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if a user visits a malicious website.
MS16-006 – Critical
Security Update for Silverlight to Address Remote Code Execution (3126036)
This security update resolves a vulnerability in Microsoft Silverlight. The vulnerability could allow remote code execution if a user visits a compromised website that contains a specially crafted Silverlight application. An attacker would have no way to force users to visit a compromised website. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email or instant message that takes users to the attacker’s website.
MS16-007 – Important
Security Update for Microsoft Windows to Address Remote Code Execution (3124901)
This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker is able to log on to a target system and run a specially crafted application.
MS16-008 – Important
Security Update for Windows Kernel to Address Elevation of Privilege (3124605)
This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application.
MS16-010 – Important
Security Update in Microsoft Exchange Server to Address Spoofing (3124557)
This security update resolves vulnerabilities in Microsoft Exchange Server. The most severe of the vulnerabilities could allow spoofing if Outlook Web Access (OWA) fails to properly handle web requests, and sanitize user input and email content.
by Mark | Dec 30, 2015 | Features, Patch Management, Patch Releases, SCCM
Adobe Flash Player – Critical Security updates released
Adobe has released critical security updates for Adobe Flash Player this month
These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system.
The exploit for CVE-2015-8651 is being used in limited, targeted attacks.
Effected versions are;
- Adobe Flash Player Desktop Runtime 20.0.0.235 and earlier
- Adobe Flash Player Extended Support Release 18.0.0.268 and earlier
- Adobe Flash Player for Google Chrom e20.0.0.228 and earlier
- Adobe Flash Player for Microsoft Edge and Internet Explorer 1120.0.0.228 and earlier
- Adobe Flash Player for Internet Explorer 10 and 1120.0.0.228 and earlier
- Adobe Flash Player for Linux 11.2.202.554 and earlier
- AIR Desktop Runtime 20.0.0.204 and earlier
- AIR SDK20.0.0.204 and earlier
- AIR SDK & Compile r20.0.0.204 and earlier
- AIR for Android 20.0.0.204 and earlier
Effecting Windows, Macintosh, Android and IOS devices
Adobe has relased a security update that fixes the vulnerability. Users are advised to update their versions of Flash to the latest versions available on the Adobe website.
Details on how to update and remediate this issue supplied by Adobe below;
- Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 20.0.0.267 by visiting the Adobe Flash Player Download Center, or via the update mechanism within the product when prompted.
- Adobe recommends users of the Adobe Flash Player Extended Support Release should update to version 18.0.0.324 by visiting http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html.
- Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.559 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 20.0.0.267 for Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge and Internet Explorer for Windows 10 will be automatically updated to the latest version, which will include Adobe Flash Player 20.0.0.267.
- Adobe Flash Player installed with Internet Explorer for Windows 8.x will be automatically updated to the latest version, which will include Adobe Flash Player 20.0.0.267.
- Adobe recommends users of the AIR desktop runtime, AIR SDK and AIR SDK & Compiler update to version 20.0.0.233 by visiting the AIR download center or the AIR developer center.
- Please visit the Flash Player Help page for assistance in installing Flash Player.
by Mark | Dec 14, 2015 | How To, Patch Management, Patch Releases, SCCM
The Ultimate Patch Management Strategy to Alleviate Your Pain
Are you tired of experiencing patch management pain every time you need to update and patch your servers? If yes, then you are not alone. Many administrators have found themselves in a daunting task of keeping their servers and workstations up to date. Fortunately, creating a great patch management strategy is not as complicated as you might think. In this article, we will show you how to implement an effective patch management strategy that will remove the pain from your process.
Infrastructure is Key
The first step towards having an effective patch management strategy is having the correct infrastructure in place. Fortunately, there are several fantastic tools that have been developed by Microsoft, such as Microsoft System Centre Configuration Manager (SCCM), Windows Update Services (WSUS), and Windows Update for Business (WUB). These tools can be used to keep your servers and workstations up to date, and they all report on patching compliance. Additionally, you can set them to deploy updates as you define, which makes the process more manageable
The Ideal World
In an ideal world, where you have Development/Test, UAT, and Production environments that mimic one another, you can successfully deploy security updates to the lower environments. This allows you to perform successful UAT to ensure that no new issues are introduced by any of the patches. Should a patch cause an issue, you can stop deployment to your Production servers, delaying deployment until a fix has been released that will address the issue or not deploying the patch at all.
The Real World
Unfortunately, not everyone has the luxury of lower environments that match the Production environment. The ability to successfully UAT patches prior to deployment to Production systems isn’t available to most administrators, making the patch deployment process fraught with risk. Administrators would have to manually confirm all backups were successful prior and perform and confirm a successful snapshot of their virtual servers for added confidence. Only then could they deploy the updates to their client servers, typically outside of business hours. If there was an issue that arose from a patch, many late-night hours would be spent either trying to uninstall the patch (if that worked) or restoring from tape backup. Either way, it was many hours and weekends late at night keeping everything up to date.
How We Can Help
We understand the pain that comes with patch management, and we have a solution to help you. SnaPatch Patch Management Software interfaces with Microsoft’s SCCM and VMWare’s vCentre and Microsoft’s System Centre Virtual Machine Manager, also known as SCVMM. This software automates the patch deployment process and allows administrators to have their weekends back. With the SnaPatch console, you can choose the servers you want to patch, what patches you want to deploy, what servers you require to be snapshotted, and what time you would like this all scheduled (a maintenance window will be set for this deployment). SnaPatch will automate all this and alert you with progress emails. Should a server’s snapshot not be successful, you will be alerted by email, and that server will be excluded from patch deployment. Should an issue arise with one of the deployed patches, you can either uninstall the patch, revert to the snapshot created by SnaPatch, or restore from backup tape.
SnaPatch – Your Solution
SnaPatch is the best patch management add-on for Microsoft’s SCCM that will help you alleviate the patching risk. With our software, you can simplify your patch management process and enjoy your weekends without the hassle of patching. Like our motto says, “Let’s make Administration EASY!” Contact us today to learn more about how SnaPatch can help you.
by Mark | Dec 11, 2015 | How To, Patch Management, Patch Releases
How to Fix Outlook 2010 Only Starting in Safe Mode Issue (KB3114409)
If you are experiencing issues with Outlook 2010 only starting in Safe Mode, you are not alone. The recent Microsoft Patch releases have caused an issue that was meant to be prevented instead of fixed. Fortunately, there is a way to address this problem.
The KB3114409 update, which was released on Patch Tuesday, was designed to prevent Outlook 2010 from starting in Safe Mode. However, it appears to have caused the opposite effect, forcing all users to use Safe Mode for Outlook and not retaining display preferences. This issue has affected many users and is still very fresh, meaning there may be other issues associated with this release.
While the core objective of the above fix was to limit Outlook 2010 opening in Safe Mode, a feature released in KB3114305, it appears as though the patch has caused unintended consequences. If you have installed the KB3114409 update, you may have found that Outlook 2010 only starts in Safe Mode, and display preferences are not being retained.
The good news is that there is a workaround. To fix the issue, you will need to uninstall or prevent the hotfix from being installed. This will return the functionality in those cases where the fix has caused issues.
For sites using Outlook 2010 with SCCM ADRs to deploy patches, it is advisable to disable this update. However, sites using Lotus Notes are not affected, as this update is specific to Outlook (and not Office) 2010.
Conclusion
If you are experiencing issues with Outlook 2010 only starting in Safe Mode, the KB3114409 update may be the culprit. Fortunately, there is a workaround to fix this problem. By uninstalling or preventing the hotfix from being installed, you can restore the functionality of Outlook 2010. Remember, if you are using SCCM ADRs to deploy patches, disable this update to avoid issues. With these simple steps, you can fix the issue and get back to using Outlook 2010 without any problems.
If you want more information about this update, visit the Microsoft site links below
https://support.microsoft.com/en-us/kb/3114409
While the core objective of the above fix was (to provide a means) to limit Outlook 2010 opening in Safe Mode, a feature released in KB3114305: https://support.microsoft.com/en-us/kb/3114305
by Mark | Dec 9, 2015 | Patch Management, Patch Releases, SCCM
Microsoft’s December 2015 Patch Releases
The following twelve Patch Tuesday updates / patches have been released by Microsoft for the December 2015 Update deployment.
MS15-112 – Critical
Cumulative Security Update for Internet Explorer (3104517)
This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS15-125 – Critical
Cumulative Security Update for Microsoft Edge (3116184)
This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS15-126 – Critical
Cumulative Security Update for JScript and VBScript to Address Remote Code Execution (3116178)
This security update resolves vulnerabilities in the VBScript scripting engine in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if an attacker hosts a specially crafted website that is designed to exploit the vulnerabilities through Internet Explorer (or leverages a compromised website or a website that accepts or hosts user-provided content or advertisements) and then convinces a user to view the website. An attacker could also embed an ActiveX control marked “safe for initialization” in an application or Microsoft Office document that uses the Internet Explorer rendering engine to direct the user to the specially crafted website.
MS15-127 – Critical
Security Update for Microsoft Windows DNS to Address Remote Code Execution (3100465)
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if an attacker sends specially crafted requests to a DNS server.
MS15-128 – Critical
Security Update for Microsoft Graphics Component to Address Remote Code Execution (3104503)
This security update resolves vulnerabilities in Microsoft Windows, .NET Framework, Microsoft Office, Skype for Business, Microsoft Lync, and Silverlight. The vulnerabilities could allow remote code execution if a user opens a specially crafted document or visits a webpage that contains specially crafted embedded fonts.
MS15-129 – Critical
Security Update for Silverlight to Address Remote Code Execution (3106614)
This security update resolves vulnerabilities in Microsoft Silverlight. The most severe of the vulnerabilities could allow remote code execution if Microsoft Silverlight incorrectly handles certain open and close requests that could result in read- and write-access violations. To exploit the vulnerability, an attacker could host a website that contains a specially crafted Silverlight application and then convince a user to visit a compromised website. The attacker could also take advantage of websites containing specially crafted content, including those that accept or host user-provided content or advertisements.
MS15-130 – Critical
Security Update for Microsoft Uniscribe to Address Remote Code Execution (3108670)
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a specially crafted document or visits an untrusted webpage that contains specially crafted fonts.
MS15-131 – Critical
Security Update for Microsoft Office to Address Remote Code Execution (3116111)
This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS15-132 – Important
Security Update for Microsoft Windows to Address Remote Code Execution (3116162)
This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow remote code execution if an attacker accesses a local system and runs a specially crafted application.
MS15-133 – Important
Security Update for Windows PGM to Address Elevation of Privilege (3116130)
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker logs on to a target system and runs a specially crafted application that, by way of a race condition, results in references to memory locations that have already been freed. Microsoft Message Queuing (MSMQ) must be installed and the Windows Pragmatic General Multicast (PGM) protocol specifically enabled for a system to be vulnerable. MSMQ is not present in default configurations and, if it is installed, the PGM protocol is available but disabled by default.
MS15-134 – Important
Security Update for Windows Media Center to Address Remote Code Execution (3108669)
This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS15-135 – Important
Security Update for Windows Kernel-Mode Drivers to Address Elevation of Privilege (3119075)
This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to a target system and runs a specially crafted application.
