Patch Tuesday Webinar Highlights

Patch Tuesday Webinar
Wednesday, November 13, 2019
Hosted by: Chris Goettl & Todd Schell
Dial in: 1-877-668-4490 (US)
Event ID: 808 925 120

Copyright©2019Ivanti.Allrightsreserved
Agenda
November 2019 Patch Tuesday Overview
In the News
Bulletins
Q & A
1
2
3
4

 Overview

 In the News

In The News . . .
 BlueKeep Update
 https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-
rdp-exploit-attacks-explained/
 https://www.zdnet.com/article/bluekeep-exploit-to-get-a-fix-for-its-bsod-
problem/
 https://healthitsecurity.com/news/microsoft-warns-bluekeep-rdp-flaw-attacks-
will-increase-urges-patch
 https://securityboulevard.com/2019/11/bluekeep-panic-as-rce-rdp-exploit-
floods-the-net/
 ADV190024 | Microsoft Guidance for Vulnerability in Trusted Platform
Module (TPM)
 https://portal.msrc.microsoft.com/en-US/security-
guidance/advisory/ADV190024

In The News . . .
 The November 2019 Update
 https://support.microsoft.com/en-us/help/4529964/windows-10-update-history
 https://support.microsoft.com/en-us/help/4517245/feature-update-via-
windows-10-version-1909-enablement-package
 End of Life is coming! Two more Patch Tuesdays until Windows 7 and Server
20082008 R2 EoL
 https://www.bleepingcomputer.com/news/microsoft/new-update-lets-windows-
users-test-extended-security-updates/
 https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/How-to-get-
Extended-Security-Updates-for-eligible-Windows/ba-p/917807
 https://forums.ivanti.com/s/article/Custom-Patch-Support-for-Microsoft-s-
Windows-7-and-Server-2008-2008-R2-Extended-Support

In The News . . .
 Intel
 Intel Processor Machine Check Error vulnerability (CVE-2018-12207)
 CVE - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-
2018-12207
 Guidance - https://support.microsoft.com/en-us/help/4530989/guidance-for-
protecting-against-intel-processor-machine-check-error-vu
 Intel Transactional Synchronization Extensions (Intel TSX) Transaction
Asynchronous Abort vulnerability (CVE-2019-11135)
 CVE - https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-
2019-11135
 Client Guidance – https://support.microsoft.com/en-us/help/4073119/protect-against-
speculative-execution-side-channel-vulnerabilities-in
 Server Guidance – https://support.microsoft.com/en-us/help/4072698/windows-
server-speculative-execution-side-channel-vulnerabilities-prot

Zero-day Exploited Vulnerabilities
 CVE-2019-1429 Scripting Engine Memory Corruption Vulnerability
 A remote code execution vulnerability exists in the way that the scripting engine handles
objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way
that an attacker could execute arbitrary code in the context of the current user. An attacker
who successfully exploited the vulnerability could gain the same user rights as the current
user. If the current user is logged on with administrative user rights, an attacker who
successfully exploited the vulnerability could take control of an affected system. An attacker
could then install programs; view, change, or delete data; or create new accounts with full
user rights.
 In a web-based attack scenario, an attacker could host a specially crafted website that is
designed to exploit the vulnerability through Internet Explorer and then convince a user to
view the website. An attacker could also embed an ActiveX control marked "safe for
initialization" in an application or Microsoft Office document that hosts the IE rendering
engine. The attacker could also take advantage of compromised websites and websites that
accept or host user-provided content or advertisements. These websites could contain
specially crafted content that could exploit the vulnerability.
 The security update addresses the vulnerability by modifying how the scripting engine
handles objects in memory.

Publicly Disclosed Vulnerabilities
 CVE-2019-1457 Microsoft Office Excel Security Feature Bypass
 A security feature bypass vulnerability exists in Microsoft Office software by not
enforcing macro settings on an Excel document. The security feature bypass by
itself does not allow arbitrary code execution. To successfully exploit the
vulnerability, an attacker would have to embed a control in an Excel worksheet
that specifies a macro should be run. To exploit the vulnerability, an attacker
would have to convince a user to open a specially crafted file with an affected
version of Microsoft Office software. The security update addresses the
vulnerability by enforcing macro settings on Excel documents.

Windows 10 Lifecycle Awareness
 Windows 10 Branch Support
Source: Microsoft

Windows 10 Lifecycle Awareness (cont)
 Enterprise LTSB/LTSC Support
 Complete Lifecycle Fact Sheet
 https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet
Source: Microsoft

Microsoft Patch Tuesday Updates of Interest
 Advisory 990001 Latest Servicing Stack Updates
 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV990001
 SSUs for all supported operating systems
 Development Tool and Component Updates
 Azure Stack
 CharkaCore
 Open Enclave SDK
 Visual Studio 2017 and 2019
 Visual Studio Code
Source: Microsoft

Weekly Patch BLOG
 Latest Patch Releases
 Microsoft and Third-party
 Security and non-Security
 CVE Analysis
 Security Events of Interest
 Host: Brian Secrist
 https://www.ivanti.com/blog/
topics/patch-tuesday

Patch Content Announcement System
Announcements Now Posted on Community Forum Pages
 https://forums.ivanti.com/s/group/CollaborationGroup/00Ba0000009oKICEA2
 Subscribe to receive email for the desired product(s)

 Bulletins

MS19-11-W10: Windows 10 Update
 Maximum Severity: Critical
 Affected Products: Microsoft Windows 10 Versions 1607, 1703, 1709, 1803, 1809,
1903, Server 2016, Server 2019, Server 1709, Server 1803, IE 11 and Microsoft Edge
 Description: This bulletin references 16 KB articles. See KBs for the list of changes.
 Impact: Remote Code Execution, Security Feature Bypass, Denial of Service,
Elevation of Privilege and Information Disclosure
 Fixes 58 Vulnerabilities: CVE-2019-1429 is known exploited. No CVEs are publicly
disclosed. See Details column of Security Update Guide for the complete list of CVEs.
 Restart Required: Requires restart
 Known Issues: See next slides

November Known Issues for Windows 10
 KB 4525232 – Windows 10
 [File Rename] Certain operations, such as rename, that you perform on files or folders that are
on a Cluster Shared Volume (CSV) may fail with the error,
“STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. This occurs when you perform the
operation on a CSV owner node from a process that doesn’t have administrator privilege.
Workaround: Perform the operation from a process that has administrator privilege or perform
the operation from a node that doesn’t have CSV ownership. Microsoft is working on a
resolution.
 KB 4525236 – Windows 10, Version 1607 and Server 2016
 [Min Password] After installing KB4467684, the cluster service may fail to start with the error
“2245 (NERR_PasswordTooShort)” if the group policy “Minimum Password Length” is
configured with greater than 14 characters. Workaround: Set the domain default "Minimum
Password Length" policy to less than or equal to 14 characters. Microsoft is working on a
resolution.
 [File Rename]

November Known Issues for Windows 10 (cont)
 KB 4525241 – Windows 10, Version 1709
 [File Rename]
 [User OOBE] When setting up a new Windows device during the Out of Box Experience
(OOBE), you might be unable to create a local user when using Input Method Editor (IME). This
issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.
Workaround: Set the keyboard language to English during user creation or use a Microsoft
Account to complete OOBE. You can set the keyboard language back to your preferred
language after user creation. See this KB for more details. Microsoft is working on a resolution.
 [File Rename]
 [User OOBE]

November Known Issues for Windows 10 (cont)
 KB 4523205 – Windows 10, Version 1809, Server 2019 All Versions
 [Asian Packs] After installing KB 4493509, devices with some Asian language packs installed
may receive the error, "0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.“
Workaround: Uninstall and reinstall any recently added language packs or select Check for
Updates and install the April 2019 Cumulative Update. See KB for more recovery details.
Microsoft is working on a resolution.
 [File Rename]
 [User OOBE]
 [User OOBE]

MS19-11-IE: Security Updates for Internet Explorer
 Affected Products: Microsoft Internet Explorer 9,10,11
 Description: The fixes that are included in the cumulative Security Update for Internet
Explorer are also included in the November 2019 Security Monthly Quality Rollup.
Installing either the Security Update for Internet Explorer or the Security Monthly
Quality Rollup installs the fixes that are in the cumulative update. This bulletin
references 11 KB articles.
 Impact: Remote Code Execution
 Fixes 2 Vulnerabilities: CVE-2019-1390, CVE-2019-1429
 Restart Required: Requires browser restart
 Known Issues: None reported

MS19-11-MR2K8: Monthly Rollup for Windows Server 2008
 Affected Products: Microsoft Windows Server 2008 and IE 9
 Description: This security update includes improvements and fixes that were a part of
update KB 4520015 (released October 15, 2019). Bulletin is based on KB 4525234.
 Security updates to Microsoft Scripting Engine, Internet Explorer, Microsoft Graphics
Component, Windows Input and Composition, Windows Virtualization, Windows Kernel,
Windows Datacenter Networking, and the Microsoft JET Database Engine.
 Protections against the Intel® Transactional Synchronization Extensions (Intel® TSX)
Transaction Asynchronous Abort vulnerability (CVE-2019-11135).
Elevation of Privilege, and Information Disclosure
 Fixes 31 + 2 (IE 9) Vulnerabilities: CVE-2019-1429 is known exploited. No CVEs
are publicly disclosed. See the Security Update Guide for the complete list of CVEs.

MS19-11-SO2K8: Security-only Update for Windows Server 2008
 Affected Products: Microsoft Windows Server 2008
 Description: This bulletin is based on KB 4525239.
 Security updates to Microsoft Graphics Component, Windows Input and Composition,
Windows Virtualization, Windows Kernel, Windows Datacenter Networking, and the Microsoft
JET Database Engine.
 Fixes 31 Vulnerabilities: No reported exploited or publicly disclosed vulnerabilities.
See Security Update Guide for the complete list of CVEs.

MS19-11-MR7: Monthly Rollup for Win 7 and Server 2008 R2
 Affected Products: Microsoft Windows 7, Server 2008 R2, and IE
Component, Windows Input and Composition, Windows Virtualization, Windows Kernel,
Windows Datacenter Networking, and the Microsoft JET Database Engine.
 Protections against the Intel® Processor Machine Check Error vulnerability (CVE-2018-12207).
 Fixes 35 + 2 IE Vulnerabilities: CVE-2019-1429 is known exploited. No CVEs are
publicly disclosed. See the Security Update Guide for the complete list of CVEs.
 Known Issues: None reported.

MS19-11-SO7: Security-only Update for Win 7 and Server 2008 R2
 Affected Products: Microsoft Windows 7 SP1, Server 2008 R2 SP1
 Description: Bulletin is based on KB 4525233.
 Security updates to Microsoft Scripting Engine, Microsoft Graphics Component, Windows Input
and Composition, Windows Virtualization, Windows Kernel, Windows Datacenter Networking,
and the Microsoft JET Database Engine.

MS19-11-MR8: Monthly Rollup for Server 2012
 Affected Products: Microsoft Server 2012 and IE
 Security updates to Microsoft Graphics Component, Internet Explorer, Windows Input and
Composition, Windows Cryptography, Windows Virtualization, Windows Kernel, Windows
Datacenter Networking, and the Microsoft JET Database Engine.
 Known Issues: [File Rename]

MS19-11-SO8: Security-only Update for Server 2012
 Affected Products: Microsoft Server 2012
Windows Cryptography, Windows Virtualization, Windows Kernel, Windows Datacenter
Networking, and the Microsoft JET Database Engine.

MS19-11-MR81: Monthly Rollup for Win 8.1 and Server 2012 R2
 Affected Products: Microsoft Windows 8.1, Server 2012 R2, and IE
Component, Windows Input and Composition, Windows Cryptography, Windows Virtualization,
Windows Kernel, Windows Datacenter Networking, and the Microsoft JET Database Engine.

MS19-11-SO81: Security-only Update for Win 8.1 and Server 2012 R2
 Affected Products: Microsoft Windows 8.1, Server 2012 R2
Windows Cryptography, Windows Virtualization, Windows Kernel, Windows Datacenter
Networking, and the Microsoft JET Database Engine.

MS19-11-EXCH: Security Updates for Exchange Server
 Affected Products: Microsoft Exchange Server 2013, 2016 and 2019
 Description: This security update fixes a vulnerability in Microsoft Exchange Server
which allows the deserialization of metadata via PowerShell. This bulletin is based on
KB 4523171.
 Impact: Remote Code Execution
 Fixes 1 Vulnerability: CVE-2019-1373
 Known Issues: Must install update with administrator privileges

MS19-11-OFF: Security Updates for Microsoft Office
 Maximum Severity: Important
 Affected Products: Excel 2010-2016, Excel 2016 for Mac, Office 2010-2016, Office
2016 and 2019 for Mac
 Description: This security update resolves vulnerabilities in several Microsoft Office
applications. This bulletin references 10 KB articles plus release notes for MacOS.
 Impact: Remote Code Execution, Security Feature Bypass, and Information
Disclosure
 Fixes 4 Vulnerabilities: CVE-2019-1402, CVE-2019-1446, CVE-2019-1448, CVE-
2019-1457
 Restart Required: Requires application restart

MS19-11-O365: Security Updates for Office 365 ProPlus and
Office 2019
 Affected Products: Office 365 ProPlus, Office 2019
 Description: This month’s update resolved various bugs and performance issues in
Microsoft Office 365 and Office 2019 applications. Information on Office 365 ProPlus
updates is available at https://docs.microsoft.com/en-us/officeupdates/release-notes-
office365-proplus
 Impact: Remote Code Execution, Security Feature Bypass, and Information
Disclosure
2019-1449
 Restart Required: Requires application restart

MS19-11-SPT: Security Updates for SharePoint Server
 Affected Products: Microsoft Enterprise SharePoint Server 2010-2019
 Description: This security update resolves a security feature bypass vulnerability that
exists if Microsoft Office does not validate URLs; an information disclosure vulnerability
that exists in Microsoft SharePoint if an attacker uploads a specially crafted file; and an
information disclosure vulnerability that exists if Microsoft Excel incorrectly discloses
the contents of its memory. This bulletin is based on 6 KB articles.
 Impact: Security Feature Bypass and Information Disclosure
 Fixes 3 Vulnerabilities: CVE-2019-1442, CVE-2019-1443, CVE-2019-1446
 Restart Required: Requires Restart

Between Patch Tuesday’s
New Product Support: CrowdStrike Falcon Sensor, Morphisec Protector
Security Updates: Adobe (6), Apple (3), CCleaner (1), Amazon Corretto (2), DropBox
(3), FireFox (5), Foxit (2), GIMP (1), Google Chrome (4), GOM Player (1), GoodSync (2),
GoToMeeting (4), LibreOffice (2), Microsoft (2), Nitro Pro (2), Node.JS (6), Oracle (3),
Notepad++ (2), Opera (5), Plex (3), PowerBI (3), Skype (1), Slack (2), Snagit (2), Splunk
Forwarder (1), Tableau (11), Thunderbird (4), Tomcat (2), ToroiseGit (1), TortoiseSVN (1),
TeamViewer (4), VMware Tools (1), VMware Workstation (1), WinSCP (1), Wireshark (2)
Non-Security Updates: AIMP (2), Azure Information Protection (1), Box Edit (1),
Beyond Compare (3), CrowdStrike (1), Google Drive (1), GoTo Opener (1), Google Backup
and Sync (2), BlueJeans (1), Mouse and Keyboard Center (1), Morphisec Protector (1),
Microsoft (44), PDF-Xchange PRO (1), Plex Media Player (1), Royal TS (1), TreeSize Free
(1), TightVNC (1), Zoom Client (2), Zoom Outlook Plugin (1)

Third Party CVE Information
 iTunes 12.10.2.3
 AI19-007, QAI121023
2019-8801, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812, CVE-2019-8813, CVE-
2019-8821, CVE-2019-8822, CVE-2019-8823
 Apple iCloud 7.15.0.10
 ICLOUD-022, QICLOUD715010
 Fixes 11 Vulnerabilities: CVE-2019-8783, CVE-2019-8784, CVE-2019-8811,
CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819, CVE-
2019-8820, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823
 WinSCP 5.15.5
 WINSCP-031, QWINSCP5155
 Fixes 2 Vulnerabilities: CVE-2019-17068, CVE-2019-17069

Third Party CVE Information (cont)
 Acrobat and Reader
 APSB19-49, QADC1902120047, QADC1701130150, QADC1500630504,
QARDC1902120047, QARDC1902120047MUI, QARDC1902120047MUI,
QARDC1701130150MUI, QARDC1500630504MUI
2019-8222, CVE-2019-8223, CVE-2019-8224, CVE-2019-8225, CVE-2019-8226

 Google Chrome 78.0.3904.87
 CHROME-264, QGC780390470
 CHROME-265, QGC780390487
2019-13700, CVE-2019-13701, CVE-2019-13702, CVE-2019-13703, CVE-2019-13704,
CVE-2019-13705, CVE-2019-13706, CVE-2019-13707, CVE-2019-13708, CVE-2019-
13709, CVE-2019-13710, CVE-2019-13711, CVE-2019-13713, CVE-2019-13714, CVE-
2019-13715, CVE-2019-13716, CVE-2019-13717, CVE-2019-13718, CVE-2019-13719,
CVE-2019-15903
 Corretto 11.0.5.10.1
 CORRETTO11-005, QCORRETTO1105
2019-2973, CVE-2019-2975, CVE-2019-2977, CVE-2019-2978, CVE-2019-
2981, CVE-2019-2983, CVE-2019-2987, CVE-2019-2988, CVE-2019-2989,
CVE-2019-2992, CVE-2019-2999

 Amazon Corretto 8 Update 232
 CORRETTO8-232, QCORRETTO8232
2019-2988, CVE-2019-2989, CVE-2019-2992, CVE-2019-2999
 Firefox 70.0
 FF19-023, QFF700
CVE-2019-11760, CVE-2019-11761, CVE-2019-11762, CVE-2019-11763,
CVE-2019-11764, CVE-2019-11765, CVE-2019-15903, CVE-2019-17000,
CVE-2019-17001, CVE-2019-17002
 Firefox ESR 68.2.0
 FFE19-6820, QFFE6820
2019-11761, CVE-2019-11762, CVE-2019-11763, CVE-2019-11764, CVE-2019-15903

 Foxit PhantomPDF 9.7.0.29478
 FIP-023, QFIP97029478
CVE-2019-13326, CVE-2019-13327, CVE-2019-13328, CVE-2019-13329,
CVE-2019-13330, CVE-2019-13331, CVE-2019-13332, CVE-2019-17183
 Foxit PhantomPDF 8.3.12.47136
 FIP-025, QFIP831247136
 Fixes 15 Vulnerabilities: CVE-2019-5031, CVE-2019-13123, CVE-2019-
13124, CVE-2019-13326, CVE-2019-13327, CVE-2019-13328, CVE-2019-
13329, CVE-2019-13330, CVE-2019-13331, CVE-2019-13332, CVE-2019-
17139, CVE-2019-17140, CVE-2019-17141, CVE-2019-17142, CVE-2019-
17183

 Java 8 Update 231
 JAVA8-231, QJAVA8U231
2019-2973, CVE-2019-2975, CVE-2019-2978, CVE-2019-2981, CVE-2019-
2983, CVE-2019-2988, CVE-2019-2989, CVE-2019-2992, CVE-2019-2996,
CVE-2019-2999, CVE-2019-11068
 Java Development Kit 8 Update 231
 JDK8-231, QJDK8U231
2019-2973, CVE-2019-2975, CVE-2019-2978, CVE-2019-2981, CVE-2019-
2983, CVE-2019-2988, CVE-2019-2989, CVE-2019-2992, CVE-2019-2996,
CVE-2019-2999, CVE-2019-11068

 Java Development Kit 11 Update 11.0.5
 JDK11-002, QJDK11U1105
2019-2973, CVE-2019-2975, CVE-2019-2977, CVE-2019-2978, CVE-2019-
2981, CVE-2019-2983, CVE-2019-2987, CVE-2019-2988, CVE-2019-2989,
CVE-2019-2992, CVE-2019-2999
 Thunderbird 68.2.0
 TB19-6820, QTB6820
CVE-2019-11760, CVE-2019-11761, CVE-2019-11762, CVE-2019-11763,
CVE-2019-11764, CVE-2019-15903

 VirtualBox 5.2.34
 OVB-027, QOVB5234
2019-3021, CVE-2019-3026, CVE-2019-3028, CVE-2019-3031
 VirtualBox 6.0.14
 OVB-028, QOVB6014
2019-3021, CVE-2019-3026, CVE-2019-3028, CVE-2019-3031

Patch Tuesday Webinar Highlights

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Patch Tuesday Webinar Highlights

Similar to Patch Tuesday Webinar Highlights (20)

More from Ivanti

More from Ivanti (20)

Recently uploaded

Recently uploaded (20)

Patch Tuesday Webinar Highlights