This month’s Patch Tuesday replace from Microsoft makes an attempt to deal with 123 distinctive safety vulnerabilities together with an pressing difficulty with Microsoft Outlook (CVE-2020-1349) and a really critical vulnerability in Windows (CVE-2020-1350). The massive distinction this month is {that a} “Patch Now” (as in proper now-now) effort might not be sufficient. With common replace cycles measured in weeks for many organizations, fast mitigation methods are required. Microsoft has provided registry-based fixes, some recommended code-based fixes, and a request to easily cease utilizing sure options.It’s not all dangerous as Flash has died, Microsoft OneDrive has a compatibility onerous block for Windows 10 Release 2004 and Microsoft has resumed non-compulsory and non-security updates once more. As at all times, you could find a useful infographic right here detailing a number of the dangers and points with this month’s July Patch Tuesday.Key Testing SituationsThis is a brand new part and displays a few of our “replace hot-spot” evaluation that covers each desktop and server platforms throughout a number of variations of Windows. Each software portfolio is exclusive and represents a definite testing profile. For this July replace cycle, we now have recognized the next areas the place additional testing could also be warranted on your setting.VPN connections, particularly in case you are downloading your updates when utilizing a VPN. Hint: don’t!
Test each digital and bodily printers.
Focus on Event Logging (Event Tracer, MSI Installer and Error Reporting).
PDF output and modifying within the newest model of Microsoft Edge.
Known IssuesEach month, Microsoft features a checklist of recognized points that relate to the working system and platforms which might be included on this replace cycle. I’ve referenced a couple of key points that relate to the newest builds from Microsoft together with:After putting in KB4493509, gadgets with some Asian language packs put in might obtain the error, “0x800f0982”
After putting in the July replace on a Windows 10 machine with a wi-fi vast space community (WWAN) LTE modem, reaching the web won’t be doable.
After putting in KB4467684, the cluster service might fail to start out with the error “2245 (NERR_PasswordTooShort)”
Certain operations, reminiscent of rename, that you just carry out on recordsdata or folders which might be on a Cluster Shared Volume (CSV) might fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. This solely applies to the ESU merchandise reminiscent of Windows 7, Windows Server 2008.
You may discover Microsoft’s abstract of Known Issues for this launch in a single web page.Major RevisionsTwo main revisions for documentation causes have been launched by Microsoft:Mitigations and WorkaroundsFor this July launch of updates, Microsoft has revealed a small variety of potential workarounds and mitigation methods that apply to vulnerabilities (CVEs) addressed this month together with:Each month, we break down the replace cycle into product households (as outlined by Microsoft) with the next fundamental groupings:Browsers (Microsoft IE and Edge)
Microsoft Windows (each desktop and server)
Microsoft Office (Including Web Apps and Exchange)
Microsoft Development platforms (ASP.NET Core, .NET Core and Chakra Core)
Adobe Flash Player
BrowsersWith a single essential replace (CVE-2020-1403) and three updates rated as vital, this month brings a comparatively gentle patch cycle for Microsoft’s browsers. CVE-2020-1403 addresses a vulnerability in how VBScript handles reminiscence the place visiting a specifically crafted web site might end result within the execution of arbitrary code run on the susceptible system. Given that this difficulty impacts Internet Explorer (IE) 11 and 9, it is a prime candidate for hidden, growing old or legacy code used inside an internally developed software. Unlike different patches this month, Microsoft has not provided any workarounds (apart from use Chromium). So, add this replace to your normal patch launch cycle.Speaking of Chromium, Microsoft has launched its newest secure channel replace (84.0.522.40), which addresses a particular vulnerability (CVE-2020-1341). Note that this newest Chromium launch will now immediate user-based warnings on system file (DLL) downloads. And I’m not positive which you could cease this replace from occurring.Microsoft WindowsThere is an urgency to this month’s replace that we now have not seen in a short while. Microsoft has tried to deal with 13 essential, and 83 vital vulnerabilities for this July Patch Tuesday. It seems like CVE-2020-1350 is “worm-able” (that means the assault can unfold from one system to a different, with out human intervention) and impacts the core DNS element within the Windows ecosystem. We can credit score CheckPoint for elevating this difficulty and it seems just like the U.S. DSH has launched an emergency directive; it might be discovered right here. If you may’t deploy this replace instantly, Microsoft recommends that you just replace the settings within the DNS portion of the registry and scale back the TCP Package Size settings.You can learn extra about this registry-based mitigation technique right here. Otherwise, add these Windows updates to your “Patch Now” launch schedule.Microsoft OfficeJuly brings a larger-than-usual variety of updates for Microsoft Office with 4 rated as essential and the remaining 17 rated as vital by Microsoft. We see the standard SharePoint safety points addressed (CVE-2020-1025, CVE-2020-1439), noting that these updates would require a server replace. The actual concern is with Microsoft Outlook (CVE-2020-1349). This Outlook vulnerability addresses a reminiscence dealing with difficulty that might result in a distant code execution situation. All a person has to do on this case, is click on on an electronic mail containing a specifically crafted hyperlink.Add this replace to your “Patch Now” deployment effort.Microsoft Development PlatformsJuly brings a comparatively small replace to the Microsoft growth platform, with one replace rated as essential (CVE-2020-1147) and the remaining updates rated as vital by Microsoft. These different 4 vital updates from Microsoft have an effect on Visual Studio and are comparatively tough to use, resulting in a better threshold for scheduling updates. Add these 4 updates to your common (totally examined) growth replace schedule.For the essential one, the place XML information is just not dealt with appropriately, Microsoft recommends an replace, however goes additional to recommend {that a} code change is required to raised deal with (extra securely) the DataSet and DataTable variable varieties. You can discover out extra right here. Adobe Flash PlayerMicrosoft has not launched any updates for Adobe merchandise this month as a part of its Patch Tuesday replace cycle. That stated, there are a selection of critical-rated updates for Adobe merchandise this month; extra is offered right here. And lastly, as we speak is the day, the day that Flash dies.
Copyright © 2020 IDG Communications, Inc.