SANS ISC: September 2015 Microsoft Patch Tuesday

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Just for clarification: MS15-100 rated Critical for clients, but color-coded as Important?

Thanks for noticing the typo. Fixed it now.

I fixed a couple other typos. Should be clearer now. Also changed the "client" rating for the last 3 as "N/A" (Not Applicable) as these affect servers only.

Thanks, Lenny & Johannes. Greatly appreciate the update. :)

Anything to be added regarding KB3075249 and KB3080149 which supposedly backport some of the tracking/spying features from Win10 back to Win7+8 and probably should be labelled as "AVOID"?

In addition to many of the updates listed above, KB3083992 was installed on my W7 X64 PC.
According to https://support.microsoft.com/en-us/kb/3083992 this is:
Microsoft security advisory: Update to improve AppLocker certificate handling: September 8, 2015
Currently the section "Additional information about this security update" of the webpage is empty, so it's not clear what was wrong.

@Visi: KB3075249 and KB3080149 were distributed earlier (end of August), see for example http://www.ghacks.net/2015/08/28/microsoft-intensifies-data-collection-on-windows-7-and-8-systems/

@ VISI et al.

From what I have deduced from this site and others, you are correct. MS nazi attempt to run talk back to MS. No interest here, though a PITA, I go through each update as needed. The greasy haired mongrel (BG) has more than enough data.... IMHO.

Regards.

See

http://www.infoworld.com/article/2981947/microsoft-windows/the-truth-about-windows-7-and-81-spy-patches-kb-3068708-3022345-3075249-and-3080149.html

I think the "backporting Windows 10 spying to Win7/8.1" argument is way overblown - or did I miss something?

- Woody Leonhard

Quoting WoodyLeonhard:See

argument is way overblown - or did I miss something?

- Woody Leonhard

Well, maybe? I am sure you meant IMHO or some other acronym? Does not one decide their next move like a game of chess? I can find NO, repeat NO legit reason why MS or some other "puffing" software wishes to track my data that benefits me. Choice is a grand thing! And for the record, no I do not have a "smart phone" BYODesruction and move away for the "virtual world". But that is me!

I will concede putting links up to reference is a lack of security judgement. Hopefully those reading this tested and opened each link by protocol, I know I did.

Cheers...

IC

FYI...

MS15-097: Description of the security update for the graphics component in Windows
- https://support.microsoft.com/en-us/kb/3086255
Last Review: 09/08/2015 17:38:00 - Rev: 2.0
"... Known issues in this security update:
After you install this security update, some programs may not run. (For example, some video games may not run.) To work around this issue, you can temporarily turn on the service for the secdrv.sys driver by running certain commands, or by editing the registry.
Note: When you no longer require the service to be running, we recommend that you turn off the service again.
Warning: This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk..."
___

Another candidate for 'HIDE' ...

Just a question to color coding of the isc rating of the patch :
you defined Patch now with text "Patch now" as white font on red background...
and Critical with text "Critical" as Black Font on red background...

what do you mean with Critical as white font on red background ? If its really just critical, shouldn't it be Black Font on red background ?

MS15-098 KB3069114 fails to install in Windows 8.0 x64.

WU returns error 0x80073712 and manual install of
Windows8-RT-KB3069114-x64.msu runs and then
states "update not installed".

running

DISM.exe /Online /Cleanup-image /Restorehealth
sfc /scannow

cleaned up some issues with 100% success but
did not enable KB3069114 install.

Machine very clean, barely used Sandy Bridge
with Intel SSD.

Just curious if you installed this update and found any applications that "don't work"

Thanks,
Andrew

Quoting PC.Tech:FYI...

MS15-097: Description of the security update for the graphics component in Windows
- https://support.microsoft.com/en-us/kb/3086255
Last Review: 09/08/2015 17:38:00 - Rev: 2.0
"... Known issues in this security update:
After you install this security update, some programs may not run. (For example, some video games may not run.) To work around this issue, you can temporarily turn on the service for the secdrv.sys driver by running certain commands, or by editing the registry.
Note: When you no longer require the service to be running, we recommend that you turn off the service again.
Warning: This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk..."
___

Another candidate for 'HIDE' ...

This is the one that I was talking about.