Another banner Patch Tuesday, with a Word zero-day and several bugs

Credit to Author: Woody Leonhard| Date: Tue, 10 Oct 2017 13:28:00 -0700

It’s going to be a banner patching month. I count 151 separate security patches and 48 Knowledge Base articles, as well as the odd Security Advisory.

The Windows patch Release Notes point to four known bugs:

The cumulative update for Win10 Creators Update, version 1703 — which sports dozens of fixes — has a couple of problems: Systems with support enabled for USB Type-C Connector System Software Interface (UCSI) may experience a blue screen or stop responding with a black screen when a system shutdown is initiated, and it may change Czech and Arabic languages to English for Microsoft Edge and other applications.

To read this article in full or to leave a comment, please click here

Read more

Microsoft sunsets Windows 10's first feature upgrade

Credit to Author: Gregg Keizer| Date: Tue, 10 Oct 2017 10:34:00 -0700

Microsoft today will deliver the final security update for Windows 10’s first feature upgrade, the version released in November 2015.

Windows 10 1511 — Microsoft labels its feature upgrades in a yymm format — will receive its last security patches, then fall off Microsoft’s support list. The company had announced 1511’s retirement several times in the past, notably in a support lifecycle fact sheet on Microsoft’s website.

Today is also October’s “Patch Tuesday,” the month’s release of security updates for Microsoft’s products. The company has tied the end of support for Windows 10’s feature upgrades to Patch Tuesdays. The next in line after 1511, last year’s 1607 — aka “Anniversary Update” — has been tentatively scheduled to drop out of support in March 2018. If true, Microsoft will undoubtedly call it quits on March 13, 2018, another Patch Tuesday.

To read this article in full or to leave a comment, please click here

Read more

Duck! Windows and Office patches are coming

Credit to Author: Woody Leonhard| Date: Tue, 10 Oct 2017 04:30:00 -0700

If you’re running Windows, do yourself a favor and put Automatic Update on a temporary hold. Then wait and see if anything comes bursting apart at the seams.

Last month, there was good reason to install specific patches shortly after they were released — at least if you couldn’t train yourself to avoid the “Enable Editing” button in Word. But by and large, if you could avoid that button, there were myriad reasons why waiting a bit before installing the September patches paid off.

To read this article in full or to leave a comment, please click here

Read more

Microsoft Patch Alert: Where we stand with September’s Windows and Office patches

Credit to Author: Woody Leonhard| Date: Tue, 26 Sep 2017 05:03:00 -0700

Microsoft’s foray into quantum computing sure sounds neat, but those of us stuck with real programs on real computers have been in something of a quandary. Once again this month, we’ve hit a bunch of stumbling blocks, many of which were pushed down the Automatic Update chute.

Before we dissect the creepy-crawlies this month, it’s important to remember that you have to get the .Net patches installed, unless you fastidiously refrain from clicking the “Enable Editing” button in Word.

To read this article in full or to leave a comment, please click here

Read more

Where we stand with messy September Windows and .NET patches

Credit to Author: Woody Leonhard| Date: Thu, 21 Sep 2017 10:54:00 -0700

This month’s Windows and .Net patches hold all sorts of nasty surprises — some acknowledged, some not, some easy to skirt, some waiting to swallow the unwary whole. Here’s a quick overview of what’s going on with this month’s missives.

Most important: If you can’t keep yourself (or your clients) from clicking “Enable Editing” in Word, you must install a broad range of .NET patches (if you’re running Windows 7 or 8.1) or cumulative updates (if you’re running Windows 10), like, NOW.

Windows 10 Creators Update version 1703

Cumulative Update KB 4038788, which brings the build number up to 15063.608, has two acknowledged (but not fixed) bugs:

To read this article in full or to leave a comment, please click here

Read more

IDG Contributor Network: Microsoft Security stopped being an oxymoron with the acquisition of Hexadite

Credit to Author: Rob Enderle| Date: Thu, 21 Sep 2017 05:00:00 -0700

One of the most frustrating things to watch during the early years of Microsoft (Disclosure: Microsoft is a client of the author) was their lack of interest in security.  It was almost as if, when anyone there heard the term, they’d cover up their ears and say “la, la, la, la, la” until you went away. And, as the century turned, Microsoft security meant anything but security, it was mostly bad joke that hit products like Windows and Internet Explorer particularly hard. But this week’s announcement (ranked as the 3rd most important acquisition this year) they are buying Hexadite showcases that over the last ten years Microsoft made a huge pivot. It finally understood that being unsecure could not only result in massive liability for the firm, but was creating a massive drag on the brand because it reflected poorly on quality. It particularly hurt sales of their products in the enterprise. 

To read this article in full or to leave a comment, please click here

Read more

Tower of Babel Outlook 2007 security patch KB 4011086 yanked, replaced

Credit to Author: Woody Leonhard| Date: Wed, 20 Sep 2017 10:44:00 -0700

With one month left until Outlook 2007 hits end of life, Microsoft released a fix yesterday for the September security patch’s polyglot ways. You may recall KB 4011086 as the Outlook 2007 patch that displays Swedish menus in the Hungarian language version, Portuguese in Italian, Swedish in Slovenian, Spanish in Italian, and many more. One hitch: You have to manually uninstall the old patch before you can install the new patch.

For those of you using Outlook 2010 who got hit with the same language switcheroo, I haven’t seen any notice that this month’s KB 4011089 has been fixed or pulled.

To read this article in full or to leave a comment, please click here

Read more

Heads up: Malware found in Piriform’s CCleaner installer

Credit to Author: Woody Leonhard| Date: Mon, 18 Sep 2017 05:22:00 -0700

If you installed the free version of CCleaner after Aug. 15, a couple of nasty programs came along for the ride. Talos Intelligence, a division of Cisco, just published a damning account of malware that it found hiding in the installer for CCleaner 5.33, the version that was released on Aug. 15 and which, according to Talos, was still the primary download on the official CCleaner page on Sept. 11.

After notifying Piriform, CCleaner was, ahem, cleaned up and version 5.34 appeared on Sept. 12.

I just checked, and the current version available from Piriform is version 5.34. (Piriform was bought by antivirus giant Avast in July.)

To read this article in full or to leave a comment, please click here

Read more