Microsoft Alerts

[AplusWebMaster]

FYI...

June's Patch Tuesday includes IE update, 18 nonsecurity patches...
- http://www.infoworld.com/article/293...y-patches.html
Jun 10, 2015 - "... Looking only at the number of security bulletins issued this month - eight - you might think June's been a walk in the park. But if you look at what's being patched and what's missing, the numbers and headaches begin to pile up... there's the obligatory giant Internet Explorer patch, MS15-056/KB 3058515, which tackles a couple dozen independently identified security holes in IE6, IE7, IE8, IE9, IE10, and IE11. If you're still using IE, it's worth noting that Microsoft has pushed out boatloads of IE patches every month over the past year except January. IE patching has turned from a comedy to a tragedy. Microsoft Edge, the browser in Windows 10, can't come a moment too soon. The other seven vulnerabilities being patched run quite a gamut, although it's worth noting that the SANS Internet Storm Center only lists one, MS15-060, as having a known exploit - and it's rated as important, not critical. SANS notes that the bulletin for MS15-062 includes a line of code that appears to be a proof-of-concept exploit. Microsoft re-released many old, nonsecurity patches this month, including KB 2952664 and KB2976978 - the Windows10 nagware patches that were re-re-re-re-released five days ago..."
(More detail at the infoworld URL above.)

- http://windowssecrets.com/patch-watc...ffice-updates/
June 11, 2015 - "... Office 2010 and 2013 both get a slew of nonsecurity fixes. June’s Patch Tuesday release was also bulked up with a bunch of reissued security updates for Office 2010 and some patches that prepare Win7 and Win8 machines for Windows 10... Microsoft has added HTTP Strict Transport Security (HSTS; more info*) to IE 11 on Windows 8.1 and 7. June’s cumulative IE update, KB 3058515, among other things, adds support for HSTS to IE clients. But actually implementing this security feature will be up to individual site developers. Rated critical, KB 3058515 patches over 20 IE vulnerabilities. It also includes seven nonsecurity fixes — among them, one that improves HTML table display speed and another that solves an issue with slow or crashing Web apps..."
* https://en.wikipedia.org/wiki/HTTP_S...sport_Security

[AplusWebMaster]

FYI...

MS Security Bulletin MS15-048 - Important
Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (3057134)
- https://technet.microsoft.com/en-us/...urity/MS15-048
May 12, 2015 | V1.1 (June 17, 2015): Corrected bulletin replacement for the 3035488 update for .NET Framework 2.0 on all affected editions of Windows Server 2003 Service Pack 2.
- https://support.microsoft.com/en-us/kb/3057134
Last Review: May 12, 2015 - Rev: 1.0
- https://support.microsoft.com/en-us/kb/3035488
Last Review: May 12, 2015 - Rev: 1.0
- https://support.microsoft.com/en-us/kb/3023220
Last Review: May 12, 2015 - Rev: 1.0

- https://web.nvd.nist.gov/view/vuln/d...=CVE-2015-1672
5.0
- https://web.nvd.nist.gov/view/vuln/d...=CVE-2015-1673
9.3 (HIGH)


___

Windows 10 Q&A
- https://www.microsoft.com/en-us/windows/windows-10-faq

.

[AplusWebMaster]

FYI... MS - miscellaneous notes:

Win8 users face patch spigot shutoff in 7 months
- http://www.computerworld.com/article...-7-months.html
Jun 19, 2015
- https://support.microsoft.com/en-us/...-windows81-faq
"What is the support lifecycle policy for Windows 8.1? Windows 8.1 falls under the same lifecycle policy as Windows 8, and will reach end of Mainstream Support on January 9, 2018, and end of Extended Support on January 10, 2023. With the General Availability of Windows 8.1, customers on Windows 8 have 2 years, until January 12, 2016, to move to Windows 8.1 in order to remain supported..."
___

An issue you might encounter after installing Microsoft Security Update 3004375
- http://blogs.technet.com/b/momteam/a...e-3004375.aspx
15 Jun 2015
___

Revised content for the Windows 10 in-place upgrade via task sequence for Configuration Manager
- http://blogs.technet.com/b/configmgr...configmgr.aspx
16 Jun 2015 - "... And now a word from our lawyers: the attached content is -not- for production use; it is a sample for evaluation only and thus subject to the Microsoft Limited Public License (see Exhibit B of the TechNet Terms of Use). This posting is provided "AS IS" with no warranties and confers no rights..."

- http://www.theinquirer.net/inquirer/...freebie-policy
Jun 22 2015

[AplusWebMaster]

FYI...

- http://windowssecrets.com/newsletter...drives/#story6
June 24, 2015 - "... This month’s leftover updating issues include an important out-of-band Adobe Flash fix and a lingering kernel patch...
- Patch Tuesday officially falls on the second Tuesday of the month. But there’s also been the somewhat unofficial Patch Tuesday on the fourth Tuesday of the month, used in the past mostly for nonsecurity updates. It now appears that Microsoft has quietly moved the release of nonsecurity fixes to the third Tuesday...
- Windows 10. Think of the new OS as a giant nonsecurity update. There’s -no- compelling reason to install it within days of its formal release. Put Win10 off for at least a couple of weeks; during that time, we’ll see whether there are reports of significant installation issues. The delay will also give third-party vendors time to tweak their applications and drivers.
Note: Make sure you have a full backup of your current system before staring the Win10 upgrade process! ..."
____

MS15-056: Cumulative security update for Internet Explorer: June 9, 2015
- https://support.microsoft.com/en-us/kb/3058515
Last Review: 06/25/2015 - Rev: 5.0
Applies to:
Internet Explorer 11
Internet Explorer 10
Windows Internet Explorer 9
Windows Internet Explorer 8
Windows Internet Explorer 7
Microsoft Internet Explorer 6.0
"Known issues: After you install this security update, you may be unable to install some ActiveX controls.
To resolve this issue, install 3072449*. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 3072449 Installation of ActiveX controls may fail in Internet Explorer in Windows 8.1 or Windows 8 (To work around this issue, run Internet Explorer as an administrator by using the Run as administrator option. To do this, right-click Internet Explorer, and then click Run as Administrator. This will enable the ActiveX controls to be installed. After ActiveX is installed, you no longer have to run Internet Explorer by using the Run as administrator option)."
* https://support.microsoft.com/en-us/kb/3072449
Last Review: 06/26/2015 - Rev: 2.0
___

MS Security Advisory 2755801
Update for Vulnerabilities in Adobe Flash Player in Internet Explorer
- https://technet.microsoft.com/en-us/...curity/2755801
V42.0 (June 23, 2015): Added the 3074219 update* to the Current Update section.
"... The update addresses the vulnerabilities described in Adobe Security bulletin APSB15-14**..."
* https://support.microsoft.com/en-us/kb/3074219
Last Review: June 23, 2015 - Rev: 1.0

** http://helpx.adobe.com/security/prod...apsb15-14.html
June 23, 2015

>> https://forums.spybot.info/showthrea...699#post464699
___

MS Security Bulletin MS15-044 - Critical
Vulnerabilities in Microsoft Font Drivers Could Allow Remote Code Execution (3057110)
- https://technet.microsoft.com/en-us/...urity/MS15-044
V2.1 (June 23, 2015): Bulletin revised to announce a detection change in the 3056819 update for Microsoft Silverlight 5. This is a detection change only. Customers who have already successfully updated their systems do not need to take any action.
___

MS Security Bulletin MS15-049 - Important
Vulnerability in Silverlight Could Allow Elevation of Privilege (3058985)
- https://technet.microsoft.com/en-us/...urity/MS15-049
V1.1 (June 23, 2015): Bulletin revised to announce a detection change in the 3056819 update for Microsoft Silverlight 5. This is a detection change only. Customers who have already successfully updated their systems do not need to take any action.

[AplusWebMaster]

FYI...

Microsoft Security Advisory 2755801
Update for Vulnerabilities in Adobe Flash Player in Internet Explorer
- https://technet.microsoft.com/en-us/...curity/2755801
July 8, 2015 V43.0 - "... updating the affected Adobe Flash libraries contained within Internet Explorer 10 and Internet Explorer 11... by 'checking for updates' using the Microsoft Update service... addresses the vulnerabilities described in Adobe Security bulletin APSB15-16*..."
* https://helpx.adobe.com/security/pro...apsb15-16.html
___

Windows nagware patches KB 2952664 and KB 2976978 install repeatedly
Microsoft released five patches on Tuesday, and at least two of them are having problems
- http://www.infoworld.com/article/294...epeatedly.html
Jul 8, 2015

> https://support.microsoft.com/en-us/kb/2952664
Last Review: 07/07/2015 - Rev: 10.0
Applies to:
Windows 7 SP1

> https://support.microsoft.com/en-us/kb/2976978
Last Review: 07/07/2015 - Rev: 11.0
Applies to:
Windows 8, 8.1 ...

[AplusWebMaster]

FYI...

- https://technet.microsoft.com/library/security/ms15-jul
July 14, 2015 - "This bulletin summary lists security bulletins released for July 2015...
(Total of -14-)

Microsoft Security Bulletin MS15-058 - Important
Vulnerabilities in SQL Server Could Allow Remote Code Execution (3065718)
- https://technet.microsoft.com/library/security/MS15-058
Important - Remote Code Execution - May require restart - Microsoft SQL Server

Microsoft Security Bulletin MS15-065 - Critical
Security Update for Internet Explorer (3076321)
- https://technet.microsoft.com/en-us/...urity/MS15-065
Critical - Remote Code Execution - Requires restart - Microsoft Windows, Internet Explorer

Microsoft Security Bulletin MS15-066 - Critical
Vulnerability in VBScript Scripting Engine Could Allow Remote Code Execution (3072604)
- https://technet.microsoft.com/en-us/...urity/MS15-066
Critical - Remote Code Execution - May require restart - Microsoft Windows

Microsoft Security Bulletin MS15-067 - Critical
Vulnerability in RDP Could Allow Remote Code Execution (3073094)
- https://technet.microsoft.com/en-us/...urity/MS15-067
Critical - Remote Code Execution - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-068 - Critical
Vulnerabilities in Windows Hyper-V Could Allow Remote Code Execution (3072000)
- https://technet.microsoft.com/en-us/...urity/MS15-068
Critical - Remote Code Execution - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-069 - Important
Vulnerabilities in Windows Could Allow Remote Code Execution (3072631)
- https://technet.microsoft.com/en-us/...urity/MS15-069
Important - Remote Code Execution - May require restart - Microsoft Windows

Microsoft Security Bulletin MS15-070 - Important
Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3072620)
- https://technet.microsoft.com/en-us/...urity/MS15-070
Important - Remote Code Execution - May require restart - Microsoft Office

Microsoft Security Bulletin MS15-071 - Important
Vulnerability in Netlogon Could Allow Elevation of Privilege (3068457)
- https://technet.microsoft.com/en-us/...urity/MS15-071
Important - Elevation of Privilege - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-072 - Important
Vulnerability in Windows Graphics Component Could Allow Elevation of Privilege (3069392)
- https://technet.microsoft.com/en-us/...urity/MS15-072
Important - Elevation of Privilege - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-073 - Important
Vulnerabilities in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (3070102)
- https://technet.microsoft.com/en-us/...urity/MS15-073
Important - Elevation of Privilege - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-074 - Important
Vulnerability in Windows Installer Service Could Allow Elevation of Privilege (3072630)
- https://technet.microsoft.com/en-us/...urity/MS15-074
Important - Elevation of Privilege - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-075 - Important
Vulnerabilities in OLE Could Allow Elevation of Privilege (3072633)
- https://technet.microsoft.com/en-us/...urity/MS15-075
Important - Elevation of Privilege - May require restart - Microsoft Windows

Microsoft Security Bulletin MS15-076 - Important
Vulnerability in Windows Remote Procedure Call Could Allow Elevation of Privilege (3067505)
- https://technet.microsoft.com/en-us/...urity/MS15-076
Important - Elevation of Privilege - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-077 - Important
Vulnerability in ATM Font Driver Could Allow Elevation of Privilege
- https://technet.microsoft.com/en-us/...urity/MS15-077
Important - Elevation of Privilege - Requires restart - Microsoft Windows
___

- http://blogs.technet.com/b/msrc/arch...y-updates.aspx
14 Jul 2015 - "... we released security updates for Microsoft Windows, Microsoft Office, Microsoft SQL Server, and Internet Explorer..."

Security Advisories released - 3

Microsoft Security Advisory 2974294
Vulnerability in MSRT Could Allow Elevation of privilege
- https://technet.microsoft.com/en-us/...curity/2974294

Microsoft Security Advisory 3057154
Update to Harden Use of DES Encryption
- https://technet.microsoft.com/en-us/...curity/3057154

Microsoft Security Advisory 3074162
Vulnerability in MSRT Could Allow Elevation of privilege
- https://technet.microsoft.com/en-us/...curity/3074162
___

July 2015 Office Updates
- http://blogs.technet.com/b/office_su...e-release.aspx
14 Jul 2015 - "... There are 16 security updates (1 bulletin) and 41 non-security updates...
Security Bulletin MS15-070: http://technet.microsoft.com/en-us/security/ms15-070
___

MS15-058: http://www.securitytracker.com/id/1032893
MS15-065: http://www.securitytracker.com/id/1032894
MS15-066: http://www.securitytracker.com/id/1032895
MS15-067: http://www.securitytracker.com/id/1032896
MS15-068: http://www.securitytracker.com/id/1032897
MS15-069: http://www.securitytracker.com/id/1032898
MS15-070: http://www.securitytracker.com/id/1032899
MS15-071: http://www.securitytracker.com/id/1032900
MS15-072: http://www.securitytracker.com/id/1032902
MS15-073: http://www.securitytracker.com/id/1032904
MS15-074: http://www.securitytracker.com/id/1032905
MS15-075: http://www.securitytracker.com/id/1032906
MS15-076: http://www.securitytracker.com/id/1032907
MS15-077: http://www.securitytracker.com/id/1032908
___

ISC Analysis
- https://isc.sans.edu/diary.html?storyid=19919
2015-07-14

.

[AplusWebMaster]

FYI...

MS Security Advisory 2755801
Update for Vulnerabilities in Adobe Flash Player in Internet Explorer
- https://technet.microsoft.com/en-us/...curity/2755801
July 15, 2015 V44.0 - "... Microsoft released an update (3079777) for Internet Explorer 10 on Windows 8, Windows Server 2012, Windows RT, and for Internet Explorer 11 on Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1. The update addresses the vulnerabilities described in Adobe Security bulletin APSB15-18*. For more information about this update, including download links, see Microsoft Knowledge Base Article 3079777**..."
* http://helpx.adobe.com/security/prod...apsb15-18.html

** https://support.microsoft.com/en-us/kb/3079777
Last Review: 07/15/2015 - Rev: 1.0

[AplusWebMaster]

FYI...

Microsoft Security Bulletin MS15-078 - Critical
Vulnerability in Microsoft Font Driver Could Allow Remote Code Execution (3079904*)
- https://technet.microsoft.com/library/security/MS15-078
July 20, 2015

* https://support.microsoft.com/en-us/kb/3079904
Last Review: 07/20/2015 - Rev: 1.0

> Microsoft issues emergency patch for critical vulnerability in Windows
Technical details are public, making it likely bug will be actively exploited.
- http://arstechnica.com/security/2015...ty-in-windows/
Jul 20, 2015 5:30pm EDT - "... critical vulnerability, which is present in all supported version of Windows... no indications at the moment that the vulnerability is being actively exploited in the wild. Still, the unscheduled issuance on Monday is an indication that the chances of exploitation are high enough to merit installation as soon as possible... The easiest way to close the security hole is to use Windows Update to install the patch..."

- https://web.nvd.nist.gov/view/vuln/d...=CVE-2015-2426
Last revised: 07/22/2015
9.3 (HIGH)
___

MS patches - fewer problems over past 3 months ...
- http://www.infoworld.com/article/295...-3-months.html
July 23, 2015 - "... it now appears that there are very few errors in Microsoft patches that were released in May, June and July 2015... list of problematic patches took a nose dive at the end of April, and hasn't bobbed back up... There's one big problem patch this month - the MS 15-058/KB 3065718 SQL Server patch has a nasty habit of installing on SQL Server 2005, even though it's -designed- for SQL Server 2008 - but the problems are well documented in the KB article*, and the relatively easy fix - remove the update - is detailed in KB 3045303**... one small problem: MS 15-072/KB 3069392 runs afoul of Cisco WebEx's ability to share screens. Cisco has already released a fix:
> https://tools.cisco.com/quickview/bug/CSCuv36151
In her monthly patch spreadsheet[4], PatchManagement.org moderator Susan Bradley also notes some reports of problems with print spoolers after installing the MS 15-072/KB 3069392 patch***, but the reports are scattered and most (but not all) seem to clear up, particularly when switching to the HP Universal driver 6.0. There's also this note from Microsoft about the re-issuing of the January patch MS 15-006/KB 3004365:
'Bulletin revised to inform customers of the July 14, 2015 reoffering of the 3004365 update for Windows 8.1 and Windows Server 2012 R2 systems. The update provides defense-in-depth measures beyond what was provided in the original update issued on January 13, 2015. Customers running these operating systems who have already successfully applied the update should -reinstall- the update to be best protected from the vulnerability discussed in this bulletin'[5] ..."

* https://support.microsoft.com/en-us/kb/3065718

** https://support.microsoft.com/en-us/kb/3045303

*** https://support.microsoft.com/en-us/kb/3069392

4] https://onedrive.live.com/view.aspx?...y&app=Excel%20

5] https://technet.microsoft.com/library/security/ms15-006
Updated: July 22, 2015

[AplusWebMaster]

FYI...

Win10 patch KB 3074683 fixes Explorer crash caused by KB 3074681
- http://www.infoworld.com/article/295...b-3074681.html
Jul 28, 2015 - "Overnight, Microsoft released a patch, dubbed KB 3074683*, which appears to fix the problems caused by a Windows 10 Technical Preview build 10240 update; the KB 3074681 patch triggered Explorer crashes in certain circumstances. If you're using build 10240, your machine probably rebooted and the fix is installed..."
(More detail at the infoworld URL above.)
* https://support.microsoft.com/en-us/kb/3074683
Last Review: 07/27/2015 - Rev: 1.0
Applies to:
Windows 10 Home, released in July 2015
Windows 10 Enterprise, released in July 2015
Windows 10 Education, released in July 2015
Windows 10 Pro, released in July 2015
___

How to temporarily prevent a Windows or driver update from reinstalling in Windows 10
- https://support.microsoft.com/en-us/kb/3073930
"Symptoms: In Windows 10, your device is always kept up to date with the latest features and fixes. Updates and drivers are installed automatically, with no need to select which updates are needed or not needed. In rare cases, a specific driver or update might temporarily cause issues with your device, and in this case you will need a way to prevent the problematic driver or update from reinstalling automatically the next time Windows Updates are installed..."
Last Review: 07/28/2015 - Rev: 5.0
Applies to:
Windows 10
Windows 10 Insider Preview

[AplusWebMaster]

FYI...

Patching collides with Win10...
- http://windowssecrets.com/patch-watc...win10-release/
July 29, 2015 - "... Microsoft made good on its promise to release a free Win10 upgrade for consumer Win7 SP1 and Win8.1 systems. I assume that those who like living dangerously have already started the upgrade process on a production machine -without- first ensuring they have complete and functional backups stored on external drives. I wish them the best of luck. But wiser Windows users will put off installing the new OS on their main systems for at least a month or two, giving Microsoft time to work out the inevitable kinks in the system..."
(More detail at the URL above.)
___

Updating to Win10: Definitely a mixed experience
- http://windowssecrets.com/top-story/...ed-experience/
July 29, 2015
___

Microsoft Security Advisory 2755801
Update for Vulnerabilities in Adobe Flash Player in Internet Explorer
- https://technet.microsoft.com/en-us/...curity/2755801
V45.0 (July 29, 2015): Added the 3074683 update for Windows 10 systems to the Current Update section.
___

Windows 10 Shares Your Wi-Fi With Contacts
- http://krebsonsecurity.com/2015/07/w...with-contacts/
July 29, 2015