The document details the August 2017 Patch Tuesday webinar, which covers critical security updates for various Microsoft products and Adobe software, including vulnerabilities that could allow remote code execution and denial of service. It outlines known issues with updates for Windows 8.1, Server 2012 R2, and Internet Explorer, emphasizing the need for caution when applying updates and ensuring language packs are installed first. Additionally, it lists multiple CVE vulnerabilities addressed in the updates and provides links for further information on the updates discussed in the webinar.

1. Patch Tuesday Webinar
Wednesday, August 9, 2017
Hosted by: Chris Goettl & Todd Schell
Dial in: 1-877-668-4490 (US)
Event ID: 807 874 549

2. Agenda
August 2017 Patch Tuesday Overview
In the News
Bulletins
Q & A
1
2
3
4

3.  Overview

5.  In the News

6. In the News - TBD
 Flash EOL - https://blogs.adobe.com/conversations/2017/07/adobe-flash-
update.html
 https://krebsonsecurity.com/2017/08/flash-player-is-dead-long-live-flash-
player/
 Windows as a Service Updated! - https://docs.microsoft.com/en-
us/windows/deployment/update/waas-overview
 Office Update with some out of band Security Fixes – 3 CVEs fixed on July 27th
in an Office update – Rated as Important

7. Public Disclosures
 CVE-2017-8627 – Windows Subsystem for Linux Denial of Service Vulnerability
 An attacker who successfully exploited this vulnerability could cause a
denial of service against the local system. A attacker could exploit this
vulnerability by running a specially crafted application. The update
addresses the vulnerability by correcting how Windows Subsystem for
Linux handles objects in memory.
 CVE-2017-8633 – Windows Error Reporting Elevation of Privilege Vulnerability
 An attacker who successfully exploited this vulnerability could gain
greater access to sensitive information and system functionality. To exploit
this vulnerability, an attacker would run a specially crafted application. This
update corrects the way the WER handles and executes files.

8. Known Issues Things to be aware of
 Monthly Rollup on Windows 8.1, Server 2012 R2 and IE Cumulative for
Windows 8.1 or Server 2012 R2
 NPS authentication may break, and wireless clients may fail to connect.
On the server, set the following DWORD registry key's value to = 0:
SYSTEMCurrentControlSetServicesRasManPPPEAP13DisableEndE
ntityClientCertCheck
 Windows Edge on Windows 10
 Installing KB 4034674 may change Czech and Arabic languages to
English for Microsoft Edge and other applications.
 Server 2008
 Almost every patch this month must be applied with all your language
packs installed first. If you apply language packs after applying these
patches it will overwrite the fixes and you will need to re-apply the patches.

9.  Bulletins

10. MS17-08-W10: Windows 10 Update
 Maximum Severity: Critical
 Affected Products: Microsoft Windows 10 1511, 1607, and 1703, Server 2016, and
Microsoft Edge
 Description: This bulletin references 4 KB articles.
 Impact: Remote Code Execution, Security Feature Bypass, Denial of Service,
Elevation of Privilege and Information Disclosure
 Fixes 42 Vulnerabilities: CVE-2017-0174, CVE-2017-0250, CVE-2017-0293, CVE-2017-8503, CVE-
2017-8591, CVE-2017-8593, CVE-2017-8620, CVE-2017-8622, CVE-2017-8623, CVE-2017-8624, CVE-2017-8627,
CVE-2017-8633, CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8637, CVE-2017-8638, CVE-2017-
8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8642, CVE-2017-8644, CVE-2017-8645, CVE-2017-8646, CVE-
2017-8647, CVE-2017-8650, CVE-2017-8652, CVE-2017-8653, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657,
CVE-2017-8659, CVE-2017-8661, CVE-2017-8662, CVE-2017-8664, CVE-2017-8666, CVE-2017-8669, CVE-2017-
8670, CVE-2017-8671, CVE-2017-8672, CVE-2017-8673, CVE-2017-8674
 Restart Required: Requires Restart
 Known Issues: Installing this KB 4034674 may change Czech and Arabic languages
to English for Microsoft Edge and other applications.

11. MS17-08-2K8: Windows Server 2008
 Maximum Severity: Critical
 Affected Products: Microsoft Windows Server 2008
 Description: This security update includes critical fixes for Windows Search and
Microsoft JET database engine that prevent remote code execution. This bulletin
references 8 KB articles.
 Impact: Remote Code Execution, Denial of Service, Elevation of Privilege and
Information Disclosure
 Fixes 9 vulnerabilities: CVE-2017-0174, CVE-2017-0250, CVE-2017-8593, CVE-2017-8620,
CVE-2017-8624, CVE-2017-8633, CVE-2017-8666, CVE-2017-8668, CVE-2017-8691
 Restart Required: Requires Restart
 Known Issues: Almost every patch this month must be applied with all your language
packs installed first. If you apply language packs after applying these patches it will
overwrite the fixes and you will need to re-apply the patches.

12. MS17-08-MR7: Monthly Rollup for Win 7 and Server 2008 R2
 Maximum Severity: Critical
 Affected Products: Microsoft Windows 7, Server 2008 R2, and IE
 Description: This security update includes improvements and fixes that were a part of
update KB 4025340 (released July 18, 2017) This bulletin includes updates for IE.
This bulletin is based on KB 4034664.
 Impact: Remote Code Execution, Denial of Service, Elevation of Privilege and
Information Disclosure
 Fixes 10 (shown) + 7 (IE) Vulnerabilities: CVE-2017-0174, CVE-2017-0250, CVE-2017-
0293, CVE-2017-8593, CVE-2017-8620, CVE-2017-8624, CVE-2017-8633, CVE-2017-8666, CVE-
2017-8668, CVE-2017-8691
 Restart Required: Requires Restart
 Known Issues: None reported

13. MS17-08-MR8: Monthly Rollup for Server 2012
 Maximum Severity: Critical
 Affected Products: Microsoft Server 2012 and IE
 Description: This security update includes improvements and fixes that were a part of
update KB 4025332 (released July 18, 2017) This bulletin includes updates for IE.
This bulletin is based on KB 4034665.
 Impact: Remote Code Execution, Denial of Service, Elevation of Privilege and
Information Disclosure
 Fixes 11 (shown) + 7 (IE) Vulnerabilities: CVE-2017-0174, CVE-2017-0250, CVE-2017-
0293, CVE-2017-8591, CVE-2017-8593, CVE-2017-8620, CVE-2017-8624, CVE-2017-8633, CVE-
2017-8664, CVE-2017-8666, CVE-2017-8668
 Restart Required: Requires Restart
 Known Issues: None reported

14. MS17-08-MR81: Monthly Rollup for Win 8.1 and Server 2012 R2
 Maximum Severity: Critical
 Affected Products: Microsoft Windows 8.1, Server 2012 R2, and IE
 Description: This security update includes improvements and fixes that were a part of
update KB 4025335 (released July 18, 2017) This bulletin includes updates for IE. This
bulletin is based on KB 4034681.
 Impact: Remote Code Execution, Denial of Service, Elevation of Privilege and
Information Disclosure
 Fixes 11 (shown) + 7 (IE) Vulnerabilities: CVE-2017-0174, CVE-2017-0250, CVE-2017-
0293, CVE-2017-8591, CVE-2017-8593, CVE-2017-8620, CVE-2017-8624, CVE-2017-8633, CVE-
2017-8664, CVE-2017-8666, CVE-2017-8668
 Restart Required: Requires Restart
 Known Issues: NPS authentication may break, and wireless clients may fail to
connect. See KB 4034681 for temporary workaround.

15. MS17-08-SO7: Security-only Update for Win 7 and Server 2008 R2
 Maximum Severity: Critical
 Affected Products: Microsoft Windows 7 and Server 2008 R2
 Description: Security updates to Windows Server, Microsoft JET Database Engine,
Windows kernel-mode drivers, Common Log File System Driver, Microsoft Windows
Search Component, and Volume Manager Driver. This bulletin is based on KB 4034679.
 Impact: Remote Code Execution, Denial of Service, Elevation of Privilege and
Information Disclosure
 Fixes 10 Vulnerabilities: CVE-2017-0174, CVE-2017-0250, CVE-2017-0293, CVE-2017-8593,
CVE-2017-8620, CVE-2017-8624, CVE-2017-8633, CVE-2017-8666, CVE-2017-8668, CVE-2017-
8691
 Restart Required: Requires Restart
 Known Issues: None reported

16. MS17-08-SO8: Security-only Update Server 2012
 Maximum Severity: Critical
 Affected Products: Microsoft Server 2012
 Description: Security updates to Microsoft Windows Search Component, and
Windows kernel-mode drivers. This bulletin is based on KB 4034666.
 Impact: Remote Code Execution, Denial of Service, Elevation of Privilege and
Information Disclosure
 Fixes 11 Vulnerabilities: CVE-2017-0174, CVE-2017-0250, CVE-2017-0293, CVE-2017-
8591, CVE-2017-8593, CVE-2017-8620, CVE-2017-8624, CVE-2017-8633, CVE-2017-8664, CVE-
2017-8666, CVE-2017-8668
 Restart Required: Requires Restart
 Known Issues: None reported

17. MS17-08-SO81: Security-only Update for Win 8.1 and Server 2012 R2
 Maximum Severity: Critical
 Affected Products: Microsoft Windows 8.1 and Server 2012 R2
 Description: Security updates to Windows Server, Microsoft Windows Search
Component, Volume Manager Driver, Common Log File System Driver, Microsoft
Windows PDF Library, Microsoft JET Database Engine, Windows kernel-mode drivers,
and Windows Hyper-V. This bulletin is based on KB 4034672. This also fixes the
previous iSCSI issues with the exception of one UI issue.
 Impact: Remote Code Execution, Denial of Service, Elevation of Privilege and
Information Disclosure
 Fixes 11 Vulnerabilities: CVE-2017-0174, CVE-2017-0250, CVE-2017-0293, CVE-2017-
8591, CVE-2017-8593, CVE-2017-8620, CVE-2017-8624, CVE-2017-8633, CVE-2017-8664, CVE-
2017-8666, CVE-2017-8668
 Restart Required: Requires Restart
 Known Issues: None reported

18. MS17-08-IE: Security Updates for Internet Explorer
 Maximum Severity: Critical
 Affected Products: Microsoft Internet Explorer 9, 10 and 11
 Description: This security update resolves several reported vulnerabilities in Internet
Explorer. The most severe of these vulnerabilities could allow remote code execution if
a user views a specially crafted webpage in Internet Explorer. The fixes included in
Security Update for Internet Explorer 4034733 are also included in the August 2017
Security Monthly Quality Rollup. Installing either the Security Update for Internet
Explorer or the Security Monthly Quality Rollup installs the fixes that are resolved in
this update. This bulletin references 8 KB articles.
 Impact: Remote Code Execution, Security Feature Bypass
 Fixes 7 vulnerabilities: CVE-2017-8625, CVE-2017-8635, CVE-2017-8636, CVE-
2017-8641, CVE-2017-8651, CVE-2017-8653, CVE-2017-8669
 Restart Required: Requires Browser Restart

19. MS17-08-AFP: Security Update for Adobe Flash Player
 Maximum Severity: Critical
 Affected Products: Adobe Flash Player
 Description: This security update resolves vulnerabilities in Adobe Flash Player that is
installed on any supported edition of Windows Server 2016, Windows Server 2012 R2,
Windows Server 2012, Windows 10, Windows 10 Version 1511, Windows 10 Version
1607, Windows 10 Version 1703, Windows 8.1, or Windows RT 8.1. This bulletin is
based on KB 4034662.
 Impact: Remote Code Execution and Information Disclosure
 Fixes 2 Vulnerabilities: CVE-2017-3085, CVE-2017-3106
 Restart Required: Requires Application Restart

20. APSB17-23: Security Update for Adobe Flash Player
 Maximum Severity: Critical (Priority 1)
 Affected Products: Adobe Flash Player
 Description: Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh, Linux and Chrome OS. These updates address a critical type
confusion vulnerability.
 Impact: Remote Code Execution and Information Disclosure
 Fixes 2 Vulnerabilities: CVE-2017-3085, CVE-2017-3106
 Restart Required: Requires Application Restart

21. FF17-011: Mozilla Foundation Security Advisory 2017-18
 Maximum Severity: Critical
 Affected Products: Firefox 55
 Description: Mozilla Foundation has released security fixes for Firefox 55
 Impact: Remote Code Execution, Security Feature Bypass, Denial of Service,
Elevation of Privilege and Information Disclosure
 Fixes 29 Vulnerabilities: See Advisory 2017-18 for the complete CVE list.
 Restart Required: Requires Application Restart

22. FFE17-5230: Mozilla Foundation Security Advisory 2017-19
 Maximum Severity: Critical
 Affected Products: Firefox ESR 52.3
 Description: Mozilla Foundation has released security fixes for Firefox ESR 52.3
 Impact: Remote Code Execution, Security Feature Bypass, Denial of Service,
Elevation of Privilege and Information Disclosure
 Fixes 29 Vulnerabilities: See Advisory 2017-19 for the complete CVE list.
 Restart Required: Requires Application Restart

23. APSB17-24: Security Update for Adobe Acrobat and Reader
 Maximum Severity: Important (Ivanti Upgrade to Critical)
 Affected Products: Adobe Acrobat and Adobe Reader
 Description: Adobe has released security updates for Adobe Acrobat and Reader for
Windows and Macintosh. These updates address vulnerabilities rated Critical and
Important that could potentially allow an attacker to take control of the affected system.
 Impact: Remote Code Execution and Information Disclosure
 Fixes 67 Vulnerabilities: See APSB17-24 for the complete CVE list.
 Restart Required: Requires Application Restart

24. MS17-08-OFF: Security Updates for Microsoft Office
 Maximum Severity: Important
 Affected Products: Sharepoint Server 2010
 Description: This security update resolves vulnerabilities in Microsoft Office that could
allow remote code execution if a user opens a specially crafted Office file. This bulletin
is based on KB 2956077.
 Impact: Spoofing
 Fixes 1 Vulnerability: CVE-2017-8654
 Restart Required: Requires Restart
 Known Issues: You must have Service Pack 2 installed on Sharepoint Server 2010
in order to install this security patch.

25. MS17-08-SQL: Security Updates for SQL Server
 Maximum Severity: Important
 Affected Products: Microsoft SQL Server 2012, 2014 and 2016
 Description: This security update fixes a vulnerability that would allow an
attacker's credentials to access an affected SQL server database. This bulletin
references 3 KB articles for this particular vulnerability. This fix is also included in
cumulative updates for the three versions. See the KBs for more details.
 Impact: Information Disclosure
 Fixes 1 Vulnerability: CVE-2017-8516
 Restart Required: Requires Restart
 Known Issues: None Reported

26. Between Patch Tuesday’s
 New Product Support: Adobe Digital Editions, Google Backup and Sync,
Azure Information Protection Client, Greenshot, Royal TS, SQL Server 2008
R2 Management Studio, Teamviewer Host
 Security Updates: Adobe AcrobatReader (1), Adobe Digital Editions (1),
Microsoft (15), Java RE 78 (3), JDK (4), Wireshark (2), iTunes (1), FileZilla
(1), Apple iCloud (1), Opera (1), Chrome (2), TortoiseGit (1), HP System
Management Homepage (1), Skype (1), SeaMonkey (1), VMware Tools (1),
NMap (1)
 Non-Security Updates: Microsoft (46), Dropbox (3), Google Backup and
Sync (2), Slack Machine-Wide Installer (2), Azure Information Protection
Client (1), Greenshot (1), Royal TS (5), TortoiseHg (1), Webex Productivity
Tools (1), TeamViewer Host (1), Nitro Pro (1), TeamViewer (1), Paint.net (1),
GoodSync (2), LibreOffice (3), VirtualBox (1), Evernote (1), Zimbra (1)

28. Thank You