Ivanti March 2017 Patch Tuesday Analysis Webinar – Formerly Shavlik

1. Patch Tuesday Webinar
Wednesday, March 15th, 2017
Chris Goettl Worlton Dial In: 1-877-668-4490 (US)
Attendees: 800 990 613

2. Agenda
March 2017 Patch Tuesday Overview
NewsKnown Issues
Bulletins
Q & A
1
2
3
4

3. Industry News
Vault 7 – The latest from Wikileaks https://www.ivanti.com/blog/vault-7-tracker/

9. CSWU-048: Cumulative update for Windows 10: March, 2017
 Maximum Severity: Critical
 Affected Products: Windows 10, IE, Edge
 Description: This update for Windows 10 includes functionality improvements and resolves the
vulnerabilities in Windows that are described in the following Microsoft security bulletins and
advisory: MS17-006, MS17-007, MS17-008, MS17-009, MS17-010, MS17-011, MS17-012, MS17-
013, MS17-016, MS17-017, MS17-018, MS17-019, MS17-021, MS17-022, MS17-023
 Impact: Remote Code Execution, Elevation of Privilege, Information Disclosure,
 Fixes 132 vulnerabilities:
 Restart Required: Requires Restart

10. SB17-002, SB17-003, SB17-004: Security Only Quality Update :
March, 2017
 Maximum Severity: Critical
 Affected Products: Windows 7, 8.1, Server 2008 R2, Server 2012, Server 2012 R2
 Description: This security update resolves the following bulletins: MS17-008, MS17-009, MS17-
010, MS17-011, MS17-012, MS17-013, MS17-016, MS17-017, MS17-018, MS17-019, MS17-021,
MS17-022
 Impact: Remote Code Execution, Elevation of Privilege, Information Disclosure,
 Fixes 81 vulnerabilities:
 Restart Required: Requires Restart

11. CR17-002, CR17-003, CR17-004: Security Monthly Quality Rollup :
March, 2017
 Maximum Severity: Critical
 Affected Products: Windows 7, 8.1, Server 2008 R2, Server 2012, Server 2012 R2
 Description: This cumulative security update resolves the following bulletins: MS17-006, MS17-
008, MS17-009, MS17-010, MS17-011, MS17-012, MS17-013, MS17-016, MS17-017, MS17-018,
MS17-019, MS17-021, MS17-022
 Impact: Remote Code Execution, Elevation of Privilege, Information Disclosure,
 Fixes 81 vulnerabilities:
 Restart Required: Requires Restart

12. MS17-006: Cumulative Security Update for Internet Explorer (4013073)
 Maximum Severity: Critical
 Affected Products: Microsoft Windows, Microsoft Internet Explorer
 Description: This security update resolves vulnerabilities in Internet Explorer. The most severe of
the vulnerabilities could allow remote code execution if a user views a specially crafted webpage
using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the
same user rights as the current user. If the current user is logged on with administrative user rights,
an attacker who successfully exploited this vulnerability could take control of an affected system. An
attacker could then install programs; view, change, or delete data; or create new accounts with full
user rights.
 Impact: Remote Code Execution
 Fixes 12 vulnerabilities: CVE-2017-0008 (Publicly Disclosed), CVE-2017-0009, CVE-2017-
0012 (Publicly Disclosed), CVE-2017-0018, CVE-2017-0033 (Publicly Disclosed), CVE-2017-
0037 (Publicly Disclosed), CVE-2017-0040, CVE-2017-0049, CVE-2017-0059, CVE-2017-0130,
CVE-2017-0149 (Exploited), CVE-2017-0154 (Publicly Disclosed)
 Restart Required: Requires Restart

13. MS17-007: Cumulative Security Update for Microsoft Edge (4013071)
 Maximum Severity: Critical
 Affected Products: Microsoft Windows, Microsoft Edge
 Description: This security update resolves vulnerabilities in Microsoft Edge. These vulnerabilities
could allow remote code execution if a user views a specially crafted webpage using Microsoft
Edge. An attacker who successfully exploited these vulnerabilities could take control of an affected
system. An attacker could then install programs; view, change, or delete data; or create new
accounts with full user rights.
 Impact: Remote Code Execution
 Fixes 32 vulnerabilities: CVE-2017-0009, CVE-2017-0010, CVE-2017-0011, CVE-2017-0012
(Publicly Disclosed), CVE-2017-0015, CVE-2017-0017, CVE-2017-0023, CVE-2017-0032, CVE-
2017-0033 (Publicly Disclosed), CVE-2017-0034, CVE-2017-0035, CVE-2017-0037 (Publicly
Disclosed), CVE-2017-0065 (Publicly Disclosed), CVE-2017-0066, CVE-2017-0067, CVE-2017-
0068, CVE-2017-0069 (Publicly Disclosed), CVE-2017-0070, CVE-2017-0071, CVE-2017-0094,
CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0135, CVE-2017-
0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0140, CVE-2017-0141, CVE-2017-0150, CVE-
2017-0151
 Restart Required: Requires Restart

14. MS17-008: Security Update for Windows Hyper-V (4013082)
 Maximum Severity: Critical
 Affected Products: Microsoft Windows
 Description: This security update resolves vulnerabilities in Microsoft Windows. The most severe
of the vulnerabilities could allow remote code execution if an authenticated attacker on a guest
operating system runs a specially crafted application that causes the Hyper-V host operating system
to execute arbitrary code. Customers who have not enabled the Hyper-V role are not affected.
 Impact: Remote Code Execution
 Fixes 11 vulnerabilities: CVE-2017-0021, CVE-2017-0051, CVE-2017-0074, CVE-2017-0075,
CVE-2017-0076, CVE-2017-0095, CVE-2017-0096, CVE-2017-0097 (Publicly Disclosed), CVE-
2017-0098, CVE-2017-0099, CVE-2017-0109
 Restart Required: Requires Restart

15. MS17-009: Security Update for Microsoft Windows PDF Library (4010319)
 Maximum Severity: Critical
 Affected Products: Microsoft Windows
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability
could allow remote code execution if a user views specially crafted PDF content online or opens a
specially crafted PDF document.
 Impact: Remote Code Execution
 Fixes 1 vulnerability: CVE-2017-0023
 Restart Required: Requires Restart

16. MS17-010: Security Update for Microsoft Windows SMB Server (4013389)
 Maximum Severity: Critical
 Affected Products: Microsoft Windows
 Description: This security update resolves vulnerabilities in Microsoft Windows. The most severe
of the vulnerabilities could allow remote code execution if an attacker sends specially crafted
messages to a Microsoft Server Message Block 1.0 (SMBv1) server.
 Impact: Remote Code Execution
 Fixes 6 vulnerabilities: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146,
CVE-2017-0147, CVE-2017-0148
 Restart Required: Requires Restart

17. MS17-011: Security Update for Microsoft Uniscribe (4013076)
 Maximum Severity: Critical
 Affected Products: Microsoft Windows
 Description: This security update resolves vulnerabilities in Windows Uniscribe. The most severe
of these vulnerabilities could allow remote code execution if a user visits a specially crafted website
or opens a specially crafted document. Users whose accounts are configured to have fewer user
rights on the system could be less impacted than users who operate with administrative user rights.
 Impact: Remote Code Execution
 Fixes 29 vulnerabilities: CVE-2017-0072, CVE-2017-0083, CVE-2017-0084, CVE-2017-
0085, CVE-2017-0086, CVE-2017-0087, CVE-2017-0088, CVE-2017-0089, CVE-2017-0090, CVE-
2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114,
CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-
0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-
2017-0126, CVE-2017-0127, CVE-2017-0128
 Restart Required: Requires Restart

18. MS17-012: Security Update for Microsoft Windows (4013078)
 Maximum Severity: Critical
 Affected Products: Microsoft Windows
 Description: This security update resolves vulnerabilities in Microsoft Windows. The most severe
of the vulnerabilities could allow remote code execution if an attacker runs a specially crafted
application that connects to an iSNS Server and then issues malicious requests to the server.
 Impact: Remote Code Execution
 Fixes 6 vulnerabilities: CVE-2017-0007, CVE-2017-0016, CVE-2017-0039, CVE-2017-0057,
CVE-2017-0100, CVE-2017-0104
 Restart Required: Requires Restart

19. MS17-013: Security Update for Microsoft Graphics Component (4013075)
 Maximum Severity: Critical
 Affected Products: Microsoft Windows, Microsoft Office, Skype for Business,
Microsoft Lync, Microsoft Silverlight
 Description: This security update resolves vulnerabilities in Microsoft Windows, Microsoft Office,
Skype for Business, Microsoft Lync, and Microsoft Silverlight. The most severe of these
vulnerabilities could allow remote code execution if a user either visits a specially crafted website or
opens a specially crafted document. Users whose accounts are configured to have fewer user rights
on the system could be less impacted than users who operate with administrative user rights.
 Impact: Remote Code Execution
 Fixes 12 vulnerabilities: CVE-2017-0001, CVE-2017-0005 (Exploited), CVE-2017-0014
(Publicly Disclosed), CVE-2017-0025, CVE-2017-0038, CVE-2017-0047, CVE-2017-0060, CVE-
2017-0061, CVE-2017-0062, CVE-2017-0063, CVE-2017-0073, CVE-2017-0108
 Restart Required: Requires Restart

20. MS17-014: Security Update for Microsoft Office (4013241)
 Maximum Severity: Important
 Affected Products: Microsoft Office, Microsoft Office Services and Web Apps,
Microsoft Server Software, Microsoft Communications Platforms and Software
 Description: This security update resolves vulnerabilities in Microsoft Office. The most severe of
the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft
Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the
context of the current user. Customers whose accounts are configured to have fewer user rights on
the system could be less impacted than those who operate with administrative user rights.
 Impact: Remote Code Execution
 Fixes 12 vulnerabilities: CVE-2017-0006, CVE-2017-0019, CVE-2017-0020, CVE-2017-
0027, CVE-2017-0029 (Publicly Disclosed), CVE-2017-0030, CVE-2017-0031, CVE-2017-0052,
CVE-2017-0053, CVE-2017-0105, CVE-2017-0107, CVE-2017-0129
 Restart Required: May Require Restart

21. MS17-017: Security Update for Windows Kernel (4013081)
 Maximum Severity: Important
 Affected Products: Microsoft Windows
 Description: This security update resolves vulnerabilities in Microsoft Windows. The
vulnerabilities could allow elevation of privilege if an attacker runs a specially crafted application.
 Impact: Elevation of Privilege
 Fixes 4 vulnerabilities: CVE-2017-0050 (Publicly Disclosed), CVE-2017-0101, CVE-2017-
0102, CVE-2017-0103
 Restart Required: Requires Restart

22. MS17-022: Security Update for Microsoft XML Core Services (4010321)
 Maximum Severity: Important
 Affected Products: Microsoft Windows
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability
could allow information disclosure if a user visits a malicious website. However, in all cases an
attacker would have no way to force a user to click a specially crafted link. An attacker would have
to convince a user to click the link, typically by way of an enticement in an email or Instant
Messenger message.
 Impact: Information Disclosure
 Fixes 1 vulnerability: CVE-2017-0022 (Exploited)
 Restart Required: Requires Restart

23. MS17-023: Security Update for Adobe Flash Player (4014329)
 Maximum Severity: Critical
 Affected Products: Microsoft Windows, Adobe Flash Player
 Description: This security update resolves vulnerabilities in Adobe Flash Player when installed
on all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2,
Windows RT 8.1, Windows 10, and Windows Server 2016.
 Impact: Remote Code Execution
 Fixes 7 vulnerabilities: CVE-2017-2997, CVE-2017-2998, CVE-2017-2999, CVE-2017-3000,
CVE-2017-3001, CVE-2017-3002, CVE-2017-3003
 Restart Required: Requires Restart

24. APSB17-07: Security Update for Adobe Flash Player (4014329)
 Maximum Severity: Critical
 Affected Products: Adobe Flash Player
 Description: Adobe has released security updates for Adobe Flash Player for Windows,
Macintosh, Linux and Chrome OS. These updates address critical vulnerabilities that could
potentially allow an attacker to take control of the affected system.
 Impact: Remote Code Execution
 Fixes 7 vulnerabilities: CVE-2017-2997, CVE-2017-2998, CVE-2017-2999, CVE-2017-3000,
CVE-2017-3001, CVE-2017-3002, CVE-2017-3003
 Restart Required:

25. VMWW-004, VMWP-028: Security Update for VMware Workstation and
Player (VMSA-2017-0005)
 Maximum Severity: Critical
 Affected Products: VMware Workstation Pro, VMware Player
 Description: VMware Workstation and Fusion updates address critical out-of-bounds
 memory access vulnerability.
 Impact: Remote Code Execution
 Fixes 1 vulnerabilities: CVE-2017-4901
 Restart Required:

26. MS17-015: Security Update for Microsoft Exchange Server (4013242)
 Maximum Severity: Important
 Affected Products: Microsoft Exchange
 Description: This security update resolves a vulnerability in Microsoft Exchange Outlook Web
Access (OWA). The vulnerability could allow remote code execution in Exchange Server if an
attacker sends an email with a specially crafted attachment to a vulnerable Exchange server.
 Impact: Remote Code Execution
 Fixes 1 vulnerability: CVE-2017-0110
 Restart Required: Requires Restart

27. MS17-016: Security Update for Windows IIS (4013074)
 Maximum Severity: Important
 Affected Products: Microsoft Windows
 Description: This security update resolves a vulnerability in Microsoft Internet Information
Services (IIS). The vulnerability could allow elevation of privilege if a user clicks a specially crafted
URL which is hosted by an affected Microsoft IIS server. An attacker who successfully exploited this
vulnerability could potentially execute scripts in the user’s browser to obtain information from web
sessions.
 Impact: Remote Code Execution
 Fixes 1 vulnerability: CVE-2017-0055
 Restart Required: Requires Restart

28. MS17-018: Security Update for Windows Kernel-Mode Drivers (4013083)
 Maximum Severity: Important
 Affected Products: Microsoft Windows
 Description: This security update resolves vulnerabilities in Microsoft Windows. The
vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs
a specially crafted application that could exploit the vulnerabilities and take control of an affected
system.
 Impact: Elevation of Privilege
 Fixes 8 vulnerabilities: CVE-2017-0024, CVE-2017-0026, CVE-2017-0056, CVE-2017-0078,
CVE-2017-0079, CVE-2017-0080, CVE-2017-0081, CVE-2017-0082
 Restart Required: Requires Restart

29. MS17-019: Security Update for Active Directory Federation Services (4010320)
 Maximum Severity: Important
 Affected Products: Microsoft Windows
 Description: This security update resolves a vulnerability in Active Directory Federation Services
(ADFS). The vulnerability could allow information disclosure if an attacker sends a specially crafted
request to an ADFS server, allowing the attacker to read sensitive information about the target
system.
 Impact: Information Disclosure
 Fixes 1 vulnerability: CVE-2017-0043
 Restart Required: Requires Restart

30. MS17-020: Security Update for Windows DVD Maker (3208223)
 Maximum Severity: Important
 Affected Products: Microsoft Windows
 Description: This security update resolves an information disclosure vulnerability in Windows
DVD Maker. The vulnerability could allow an attacker to obtain information to further compromise a
target system.
 Impact: Information Disclosure
 Fixes 1 vulnerability: CVE-2017-0045
 Restart Required: Requires Restart

31. MS17-021: Security Update for Windows DirectShow (4010318)
 Maximum Severity: Important
 Affected Products: Microsoft Windows
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability
could allow an information disclosure if Windows DirectShow opens specially crafted media content
that is hosted on a malicious website. An attacker who successfully exploited the vulnerability could
obtain information to further compromise a target system.Impact: Information Disclosure
 Fixes 1 vulnerability: CVE-2017-0042
 Restart Required: Requires Restart

32. APSB17-08: Security update available for Adobe Shockwave Player
 Maximum Severity: Important
 Affected Products: Adobe Shockwave Player
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability
could allow an information disclosure if Windows DirectShow opens specially crafted media content
that is hosted on a malicious website. An attacker who successfully exploited the vulnerability could
obtain information to further compromise a target system.
 Impact: Escalation of Privilege
 Fixes 1 vulnerability: CVE-2017-2983
 Restart Required:

34. Resources and Webinars
Get Shavlik Content Updates
Get Social with Shavlik
Sign up for next months
Patch Tuesday Webinar
Watch previous webinars
and download presentation.

35. Thank You