1 2 3 Previous Next

PatchZone

61 Posts authored by: Lawrence Garvin

On Thursday (Dec 4) Microsoft announced the forthcoming content for Patch Tuesday – Dec 8, 2014.


Number of Releases: 7

Critical Security Updates: 3 addressing vulnerabilities in Windows, Internet Explorer, Microsoft Office, Sharepoint Server, and Office Web Apps

Important Security Updates: 4 addressing vulnerabilities in Windows, Microsoft Office, Exchange Server,

 

You can have Microsoft's security bulletins sent directly to you:

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.

You can also follow the MSRC team at @MSFTSecResponse.


Updates are typically released by Microsoft at 10am PDT (5pm UTC).

Configuring WSUS servers to synchronize relative to that time can be helpful in expediting availability of these security updates.

On Thursday (Nov 6) Microsoft announced the forthcoming content for Patch Tuesday – Nov 11, 2014.


Number of Releases: 16

Critical Security Updates: 5 addressing vulnerabilities in Windows and Internet Explorer.

Important Security Updates: 9 addressing vulnerabilities in Windows, Office 2007, Sharepoint Server 2010, and Exchange Server 2007/2010/2013.

Moderate Security Updates: 2 addressing vulnerabilities in Windows, Internet Explorer, and Office 2007.

 

You can have Microsoft's security bulletins sent directly to you:

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.

You can also follow the MSRC team at @MSFTSecResponse.


Updates are typically released by Microsoft at 10am PDT (5pm UTC).

Configuring WSUS servers to synchronize relative to that time can be helpful in expediting availability of these security updates.

On Thursday (Oct 9) Microsoft announced the forthcoming content for Patch Tuesday – Oct 14, 2014.


Number of Releases: 9

Critical Security Updates: 3 addressing vulnerabilities in Windows and Internet Explorer.

Important Security Updates: 4 addressing vulnerabilities in Windows, Office 2007, Office 2010, Office for Mac 2011, Office Compatibility Pack, and Office Wep Apps Server 2010

Moderate Security Updates: 1 addressing vulnerabilities in Windows and Office 2007 IME (Japanese)

 

You can have Microsoft's security bulletins sent directly to you:

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.


Microsoft also hosts a webcast where they discuss the releases, typically the Wednesday after Patch Tuesday:

Microsoft will host a webcast to address customer questions on the security bulletins on Wed October 15, 2014, at 11:00 AM Pacific Time (US & Canada).

Register now for the October Security Bulletin Webcast.

You can also follow the MSRC team at @MSFTSecResponse.


Updates are typically released by Microsoft at 10am PDT (5pm UTC).

Configuring WSUS servers to synchronize relative to that time can be helpful in expediting availability of these security updates.

On Thursday (Sep 4) Microsoft announced the forthcoming content for Patch Tuesday – Sep 9, 2014.


Number of Releases: 4

Critical Security Updates: 1 addressing vulnerabilities in Internet Explorer.

Important Security Updates: 3 addressing vulnerabilities in Windows and Lync Server.

 

You can have Microsoft's security bulletins sent directly to you:

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.


Microsoft also hosts a webcast where they discuss the releases, typically the Wednesday after Patch Tuesday:

Microsoft will host a webcast to address customer questions on the security bulletins on Wed September 10, 2014, at 11:00 AM Pacific Time (US & Canada).

Register now for the September Security Bulletin Webcast.

You can also follow the MSRC team at @MSFTSecResponse.


Updates are typically released by Microsoft at 10am PDT (5pm UTC).

Configuring WSUS servers to synchronize relative to that time can be helpful in expediting availability of these security updates.

On Thursday (Aug 7) Microsoft announced the forthcoming content for Patch Tuesday – Aug 12, 2014.


Number of Releases: 9

Critical Security Updates: 2 addressing vulnerabilities in Windows, Internet Explorer, and the Windows Media Center TV Pack for Windows Vista.

Important Security Updates: 7 addressing vulnerabilities in Windows, .NET Framework, SQL Server, Sharepoint Server 2013, and OneNote 2007.

 

You can have Microsoft's security bulletins sent directly to you:

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.


Microsoft also hosts a webcast where they discuss the releases, typically the Wednesday after Patch Tuesday:

Microsoft will host a webcast to address customer questions on the security bulletins on Wed August 13, 2014, at 11:00 AM Pacific Time (US & Canada).

Register now for the August Security Bulletin Webcast.

You can also follow the MSRC team at @MSFTSecResponse.


Updates are typically released by Microsoft at 10am PDT (5pm UTC).

Configuring WSUS servers to synchronize relative to that time can be helpful in expediting availability of these security updates.

On Wednesday (Jul 3) Microsoft announced the forthcoming content for Patch Tuesday – Jul 8, 2014.


Number of Releases: 6

Critical Security Updates: 2 addressing vulnerabilities in Windows and Internet Explorer.

Important Security Updates: 3 addressing vulnerabilities in Windows.

Moderate Security Updates: 1 addressing vulnerabilities in Microsoft Service Bus for Windows Server.


You can have Microsoft's security bulletins sent directly to you:

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.


Microsoft also hosts a webcast where they discuss the releases, typically the Wednesday after Patch Tuesday:

Microsoft will host a webcast to address customer questions on the security bulletins on Wed Jul 9, 2014, at 11:00 AM Pacific Time (US & Canada).

Register now for the July Security Bulletin Webcast.

You can also follow the MSRC team at @MSFTSecResponse.


Updates are typically released by Microsoft at 10am PDT (5pm UTC).

Configuring WSUS servers to synchronize relative to that time can be helpful in expediting availability of these security updates.

On Thursday (Jun 5) Microsoft announced the forthcoming content for Patch Tuesday – Jun 10, 2014.


Number of Releases: 7

Critical Security Updates: 2 addressing vulnerabilities in Windows, Internet Explorer, Office, and Lync.

Important Security Updates: 5 addressing vulnerabilities in Windows, Office, and Lync.


You can have Microsoft's security bulletins sent directly to you:

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.


Microsoft also hosts a webcast where they discuss the releases, typically the Wednesday after Patch Tuesday:

Microsoft will host a webcast to address customer questions on the security bulletins on Wed Jun 11, 2014, at 11:00 AM Pacific Time (US & Canada).

Register now for the June Security Bulletin Webcast.

You can also follow the MSRC team at @MSFTSecResponse.


Updates are typically released by Microsoft at 10am PDT (5pm UTC).

Configuring WSUS servers to synchronize relative to that time can be helpful in expediting availability of these security updates.

On Thursday (May 8) Microsoft announced the forthcoming content for Patch Tuesday – May 13, 2014.


Number of Releases: 8

Critical Security Updates: 2 addressing vulnerabilities in Internet Explorer, SharePoint Server, Project Server, WebApps Server, and Sharepoint Designer.

Important Security Updates: 6 addressing vulnerabilities in Windows, Internet Explorer, and Office.


You can have Microsoft's security bulletins sent directly to you:

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.


Microsoft also hosts a webcast where they discuss the releases, typically the Wednesday after Patch Tuesday:

Microsoft will host a webcast to address customer questions on the security bulletins on Wed May 14, 2014, at 11:00 AM Pacific Time (US & Canada).

Register now for the May Security Bulletin Webcast.

You can also follow the MSRC team at @MSFTSecResponse.


Updates are typically released by Microsoft at 10am PDT (5pm UTC).

Configuring WSUS servers to synchronize relative to that time can be helpful in expediting availability of these security updates.

On Thursday (April 3) Microsoft announced the forthcoming content for Patch Tuesday – Apr 8, 2014.

 

Number of Releases: 4

Critical Security Updates: 2 addressing vulnerabilities in Windows, Internet Explorer, SharePoint Server 2010/2013, and Word 2003/2007/2010/2013.

Important Security Updates: 2 addressing vulnerabilities in Windows, Internet Explorer, Publisher 2003/2007.


You can have Microsoft's security bulletins sent directly to you:

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.


Microsoft also hosts a webcast where they discuss the releases, typically the Wednesday after Patch Tuesday:

Microsoft will host a webcast to address customer questions on the security bulletins on Wed Apr 9, 2014, at 11:00 AM Pacific Time (US & Canada).

Register now for the April Security Bulletin Webcast.

You can also follow the MSRC team at @MSFTSecResponse.


Updates are typically released by Microsoft at 10am PDT (5pm UTC).

Configuring WSUS servers to synchronize relative to that time can be helpful in expediting availability of these security updates.


SPECIAL NOTES

Windows XP End Of Support - in case you haven't already heard... TODAY is the last day that updates for Windows XP will be released to the public. No additional updates will be available for Windows XP (unless you've purchased a Microsoft Premier Support Contract that covers additional security updates for Windows XP). You should also be prepared to hear about new vulnerabilities in Windows XP and Internet Explorer v6, v7, and v8, that will not be patched... possibly as soon as Wednesday, but likely for a very long period afterward. Ensure that you have current AV/AM software installed on any remaining Windows XP systems, and I would also suggest switching those users from IE8 to the current version of Firefox or Chrome if its is necessary to use the Internet from a Windows XP system. Best case: Windows XP should not be used to access the Internet or read email.


Windows 8.1 / Windows Server 2012 R2 UPDATE -- Also on this Patch Tuesday (April 8, 2014), Microsoft is releasing the UPDATE for Windows 8.1 and Windows Server 2012 R2 systems. This UPDATE is MANDATORY -- in that all subsequent updates for Win8.1/WS2012R2 systems will be baselined from this update. That is to say, you WILL NOT be able to install the May 2014 updates to a Win8.1/WS2012R2 system unless you first have installed this April update. In addition, I've read reports that this update can take a LOOONG TIME to install... so plan accordingly. I would also NOT install this update in combination with anything else, and I would install it *AFTER* you've installed the regular April Security Updates for Win8.1/WS2012R2/IE11. Some have even suggested doing a FULL SYSTEM BACKUP prior to launching the installation of this update.

On Thursday (Mar 6) Microsoft announced the forthcoming content for Patch Tuesday – Mar 11, 2014.

 

Number of Releases: 5

Critical Security Updates: 2 addressing vulnerabilities in Windows, Internet Explorer.

Important Security Updates: 3 addressing vulnerabilities in Windows, Internet Explorer, and Silverlight.


You can have Microsoft's security bulletins sent directly to you:

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.


Microsoft also hosts a webcast where they discuss the releases, typically the Wednesday after Patch Tuesday:

Microsoft will host a webcast to address customer questions on the security bulletins on Wed Mar 12, 2014, at 11:00 AM Pacific Time (US & Canada).

Register now for the March Security Bulletin Webcast.

You can also follow the MSRC team at @MSFTSecResponse.


Updates are typically released by Microsoft at 10am PDT (5pm UTC).

Configuring WSUS servers to synchronize relative to that time can be helpful in expediting availability of these security updates.

On Thursday (Feb 6) Microsoft announced the forthcoming content for Patch Tuesday – Feb 10, 2014.

 

Number of Releases: 7

Critical Security Updates: 4 addressing vulnerabilities in Windows XP/Vista/7/8/8.1, Windows Server 2012/2012R2, Windows RT/RT8.1, Internet Explorer (all versions), and Forefront Protection 2010 for Exchange Server.

Important Security Updates: 3 addressing vulnerabilities in Windows XP/Vista/78/8.1, Windows Server 2003/2008/2008R2/2012/2012R2, Iand Internet Explorer (all versions).


You can have Microsoft's security bulletins sent directly to you:

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.


Microsoft also hosts a webcast where they discuss the releases, typically the Wednesday after Patch Tuesday:

Microsoft will host a webcast to address customer questions on the security bulletins on Feb 12, 2014, at 11:00 AM Pacific Time (US & Canada).

Register now for the February Security Bulletin Webcast.

You can also follow the MSRC team at @MSFTSecResponse.


Updates are typically released by Microsoft at 10am PDT (5pm UTC).

Configuring WSUS servers to synchronize relative to that time can be helpful in expediting availability of these security updates.

Yesterday (Tue Feb 4), Adobe published a Security Bulletin and released an emergency patch for Flash v12 (for Windows and MacOS) and Flash v11 (for Linux) to address the vulnerability documented in CVE-2014-0497.

 

Concurrent with that, Microsoft has released patches for IE10 and IE11 (which have Flash embedded) as KB2929825. Make special note that this update is not cumulative, and it does require that the January update, KB2916266 is installed first.

 

The vulnerability is related to an integer underflow in Adobe Flash Player that allows remote attackers to execute arbitrary code via unspecified vectors. The vulnerabiity is being actively exploited.

 

How bad is it.... I'm still trying to track down authoritative information on that, but considering that next Tuesday, Feb 11, would have been the regular release of updates for Adobe products, it seems that Adobe felt this warranted being pushed a week earlier. If you're interested in an in-depth analysis, this is the original article reporting the discovery of the active zero-day exploit by Kaspersky.

On Thursday (Jan 9) Microsoft announced the forthcoming content for Patch Tuesday – Jan 14, 2014.

 

Number of Releases: 4

Critical Security Updates: NONE! :-)

Important Security Updates: 4 addressing vulnerabilities in Windows XP/2003, Windows7/2008R2, Word 2003/2007/2010/2013, Sharepoint Server 2010/2013, Office Web Apps 2010/2013, and Dynamics AX 4/2009/2012.

 

You can have Microsoft's security bulletins sent directly to you:

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.

 

Microsoft also hosts a webcast where they discuss the releases, typically the Wednesday after Patch Tuesday:

Microsoft will host a webcast to address customer questions on the security bulletins on Jan 15, 2014, at 11:00 AM Pacific Time (US & Canada).

Register now for the January Security Bulletin Webcast.

You can also follow the MSRC team at @MSFTSecResponse.

 

Updates are typically released by Microsoft at 10am PDT (5pm UTC).

Configuring WSUS servers to synchronize relative to that time can be helpful in expediting availability of these security updates.

On Thursday (Dec 5) Microsoft announced the forthcoming content for Patch Tuesday – Dec 10, 2013.

 

Number of Releases: 11

Critical Security Updates: 5 addressing vulnerabilities in Windows, Internet Explorer, Office 2003/2007/2010, and Exchange Server 2007/2010/2013

Important Security Updates: 6 addressing vulnerabilities in Windows, Office 2007/2010/2013, Sharepoint Server 2010/2013, Lync 2010/2013, and Team Foundation Server 2013,

 

You can have Microsoft's security bulletins sent directly to you:

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.

 

Microsoft also hosts a webcast where they discuss the releases, typically the Wednesday after Patch Tuesday:

Microsoft will host a webcast to address customer questions on the security bulletins on Dec 11, 2013, at 11:00 AM Pacific Time (US & Canada).

Register now for the December Security Bulletin Webcast.

You can also follow the MSRC team at @MSFTSecResponse.

 

Updates are typically released by Microsoft at 10am PDT (5pm UTC).

Configuring WSUS servers to synchronize relative to that time can be helpful in expediting availability of these security updates.

One of the lesser known (or understood) features of WSUS is the ability to assign a computer to more than one Target Group. Multiple Target Groups can be useful for managing special-case approval needs for a specific update, as when a small subset of computers should not receive a particular update. They can also be useful for creating custom reporting groups, when used in conjunction with the WSUS Reporting capability for filtering by Target Group.

 

When using multiple Target Groups to manage approvals, there’s often a question of the effective approval for an update.

 

  • If you have two peer groups and Update ‘A’ is Approved for Group ‘A’ and Update ‘A’ is Not Approved for Group ‘B’, then Group ‘A’ gets the update and Group ‘B’ does not. If a computer belongs to both groups, then the computer gets the update, because, unlike AD or NTFS ACLs, there is no “Deny” operation on a per-group basis. All it takes is one approval from one group where a computer has membership.
  • If you have a parent-child group, and Update ‘A’ is Approved for the Parent Group, by default the Child Group will inherit that approval unless explicitly marked as Not Approved for the child group.

 

In the case where a handful of systems need to NOT get an update, the only practical way to implement the solution is with a Parent->Child group, where the Child Group is the group of exclusions. The advantage to this is that the six systems will inherit all of the existing approvals from the Parent Group, but the specific update of interest can be set to Not Approved for the child group.

 

If you create peer groups, then you must remove the six machines from the original group or they’ll still have an approval for the unwanted update. Also, you’ll have to replicate all of the existing approvals from the existing group to the new group. Finally, removing a  computer from an existing (normal) group can be undesirable for many reasons, the most notable being reporting. For organizations that report by target group, removing systems from a regularly-assigned target group will negatively impact reporting. In the end, just way too much work to achieve the objective desired.

 

When the issue affecting the special-handling update goes away (i.e. the update is fixed, superseded, or expired), the only ‘undo’ that is required is to remove the systems from the child group and delete the group.

SolarWinds uses cookies on its websites to make your online experience easier and better. By using our website, you consent to our use of cookies. For more information on cookies, see our cookie policy.