January 2021 updates are here

[Susan Bradley]

So this is the time of the Patch Tuesday that I call “Reading time”.  I start reading all the security blogs about patching and start seeing if there
[See the full post at: January 2021 updates are here]

Susan Bradley Patch Lady

5 users thanked author for this post.

gamezenchill, joltar, jburk07, geekdom, abbodi86

Reply | Quote

[PKCano]

AKB 2000003 has been updated for Group B Win7 (ESU) and Win8.1 on January 12, 2021.

There is a Security-only Update for those with Win7 ESU subscriptions.
There was no January IE11 CU for Win7.

January Rollup KB4598279 Download 32-bit or 64-bit for those with Win7 ESU subscriptions.

You must have at least the August Servicing Stack KB4570673 previously installed to receive these updates).
The latest is the December Servicing Stack KB4592510 – Download 32-bit or 64-bit for those with Win7 ESU subscriptions.

There is a revised Licensing Preparation Package KB4575903 dated 7/29/2020 for Win7 ESU subscriptions, if you need it.

There are .NET updates listed for Win7. See #2331747.

5 users thanked author for this post.

TaskForce141, jburk07, SueW, Kirsty, abbodi86

Reply | Quote

[Microfix]

PKCano wrote:

There is a January Servicing Stack

Where is the January SSU for Windows 7 ESU?
kb4592510 is the SSU from December 2020..

W10, the itch you simply cannot scratch!

1 user thanked author for this post.

PKCano

Reply | Quote

[PKCano]

Ooops. It is Dec. – corrections made.

1 user thanked author for this post.

Microfix

Reply | Quote

[WCHS]

Is there a January SSU for Version 1909?

Reply | Quote

[b]

Yes:

ADV990001 Security Advisory – Latest Servicing Stack Updates

1 user thanked author for this post.

WCHS

Reply | Quote

[WCHS]

But, I see only “Windows 10 1909/Windows Server, version 1909” there. I don’t see any non-server Windows 10, version 1909.

Thanks for the link. I will know where to look in the future now.

Reply | Quote

[WCHS]

I mis-spoke. After scrolling down to the CVSS section in that link, I find 4598479 for Windows 10 Version 1909 for x64-based Systems. It doesn’t appear in the upper SSU section.

What’s the difference between SSUs and CVSSs?

ghacks.net doesn’t list it.

Reply | Quote

[anonymous]

Thank you for doing that but I rarely keep up here. Reading about problems all the time increases anxiety out of proportion to reality. Instead,  the week before patches are released is my patch time. Before biting the bullet, I search for the KB number. Usually, dust is settled due to those who discover problems early by intent or otherwise.  My thanks to the victims and those who proceed cautiously via VM,  as well.

Reply | Quote

[Susan Bradley]

You don’t have to read… I read and watch for you 🙂

Susan Bradley Patch Lady

6 users thanked author for this post.

jburk07, Chris B, Alex5723, CADesertRat, SkipH, wavy

Reply | Quote

[Microfix]

Regarding CVE-2021-1647, if someone uses a 3rd party AV solution that disables Defender/ Windows Defender/ Microsoft Defender (OS dependant), how do MS update the integrated security solutions if disabled? I get the impression these need to be active to receive an update..

W10, the itch you simply cannot scratch!

Reply | Quote

[abbodi86]

Can it be exploited if it’s disabled?

Reply | Quote

[Kobold Curry Chef]

Sophos said no, for whatever that’s worth.

Reply | Quote

[anonymous]

PKCano wrote:

AKB 2000003 has been updated for Group B Win7 (ESU) and Win8.1 on January 12, 2021.

There is a Security-only Update for those with Win7 ESU subscriptions.
There was no January IE11 CU for Win7.

January Rollup KB4598279 Download 32-bit or 64-bit for those with Win7 ESU subscriptions.

You must have at least the August Servicing Stack KB4570673 previously installed to receive these updates).
The latest is the December Servicing Stack KB4592510 – Download 32-bit or 64-bit for those with Win7 ESU subscriptions.

There is a revised Licensing Preparation Package KB4575903 dated 7/29/2020 for Win7 ESU subscriptions, if you need it.

There are .NET updates listed for Win7. See #2331747.

There is also a Security update for the forgotten OS Windows 8.1.

https://support.microsoft.com/en-us/help/4535680/security-update-for-secure-boot-dbx

Reply | Quote

[Alex5723]

While 1809, 1903, 1909 have : Fixed an issue with chkdsk /f potentially damaging the file system.
Windows 2004, 20H2 doesn’t have this fix.

https://www.ghacks.net/2021/01/12/microsoft-windows-security-updates-january-2021-overview/

Reply | Quote

[Susan Bradley]

It was fixed earlier.  https://borncity.com/win/2020/12/21/windows-10-2004-20h2-microsoft-fixes-chkdsk-issue-in-update-kb4592438/

Susan Bradley Patch Lady

1 user thanked author for this post.

Alex5723

Reply | Quote

[b]

I like the prompt to set active hours. That could/should have been done years ago.

Attachments:

You must be logged in to access attached files.

Reply | Quote

[bbearren]

I got the same two updates shown in your graphic, Malicious Software Removal Tool and

KB4598242 Cumulative Update for Windows 10 Version 20H2 for x64-based Systems

I didn’t get the prompt for active hours, probably because I’ve had mine set from the git-go with Windows 10.

Did the reboot, and all is well, no hiccups.

Create a fresh drive image before making system changes/Windows updates, in case you need to start over!

"When you're troubleshooting, start with the simple and proceed to the complex."—M.O. Johns

"Experience is what you get when you're looking for something else."—Sir Thomas Robert Deware

Computer Specs

Reply | Quote

[E Pericoloso Sporgersi]

Likewise. 

Reply | Quote

[bbearren]

bbearren wrote:

I got the same two updates shown in your graphic, Malicious Software Removal Tool and KB4598242 Cumulative Update for Windows 10 Version 20H2 for x64-based Systems

Just updated the B side (very much non-supported by Microsoft) of my dual boot, no hiccups, but much faster installation that on my A side.

Create a fresh drive image before making system changes/Windows updates, in case you need to start over!

"When you're troubleshooting, start with the simple and proceed to the complex."—M.O. Johns

"Experience is what you get when you're looking for something else."—Sir Thomas Robert Deware

Computer Specs

Reply | Quote

[abbodi86]

Long live Office 2010 🙂

5 users thanked author for this post.

alphacharlie, L95, SueW, WCHS, PKCano

Reply | Quote

[L95]

I agree with abbodi86.  Windows Updates has offered me four updates for Office 2010,  and I’m really thankful for that, because it means I don’t have to spend any time this month dealing with security updates for my Office 2010 (such as upgrading to a newer version of Office).   I can use the time instead to go through the installation process for my second year of  Windows 7 Extended Security Updates (ESUs).   I’ve paid the money,  but I haven’t installed them yet, and it seemed kind of time-consuming when I installed them one year ago for the first year of ESUs, and so I’m expecting that it will take some time to deal with that.

Reply | Quote

[lylejk]

Yeah; I go where angel’s fear to tread and installed this month’s patches; took unusually longer then usual, but all installed (I do have an older machine which might explain some of this).    🙂

Reply | Quote

[WCHS]

What is KB4535680 Security Update for Windows 10 version 1909 for x64-based Systems for Secure Boot DBX? I read MS-Catalog 4535680 1909. The update has some problems with BitLocker and the MS bulletin has workarounds (or no workaround = contact your firmware OEM).

I have BitLocker available on my system, but it is not activated.

Maybe, I should just keep it hidden??

Reply | Quote

[Susan Bradley]

If you are soon to update to 2004 it’s included in there.

Susan Bradley Patch Lady

Reply | Quote

[Berserker79]

Same question here. I’m not planning to move to 2004/20H2 until April/May, so I’d like to hear whether KB4535680 should just be kept hidden.

At this very moment wushowhide is working to hide this update (as well as all others offered this month), but I was wondering whether this update is something worth installing once MS-DEFCON is raised later this month or whether it is something like those CPU microcode patches that some people here suggest to keep hidden.

1 user thanked author for this post.

WCHS

Reply | Quote

[Susan Bradley]

It’s a redo (per my read) HP Commercial Desktops, Notebooks, and Thin Clients PCs – Installing or Upgrading to Windows 10 Version 2004 or Installing KB4524244 or KB4535680 Results in Hang | HP® Customer Support

CVE-2020-0689 – Security Update Guide – Microsoft – Microsoft Secure Boot Security Feature Bypass Vulnerability

And you’ll want to make sure you are on the latest BIOS update.

I would hide it.  The way I read it, you need physical access before an attack can be made.

Susan Bradley Patch Lady

2 users thanked author for this post.

jburk07, Berserker79

Reply | Quote

[WCHS]

My two devices are Dell Inspirons, not HP.

Reply | Quote

[Susan Bradley]

It’s not specific to HP, that just happens to be an old post I found.

Susan Bradley Patch Lady

Reply | Quote

[EP]

It looks like KB4535680 is also being offered thru WU on my dad’s Toshiba 2013 Satellite C55Dt-A laptop running Win10 v2004.

I’ll definitely pass (aka. hide/block) on that update for a while

• This reply was modified 2 months, 4 weeks ago by EP.

Reply | Quote

[EP]

Important note – the KB4598229 update is for 1909 only
https://support.microsoft.com/en-us/help/4598229/windows-10-update-kb4598229

this update will not install on (nor is applicable to) 1903 because obviously 1903 went out of support in Dec. 2020

Reply | Quote

[abbodi86]

It can be installed via Dism on 1903

but it’s not advisable to install the update manually
leave it to WU to detect if your device is compatible

Reply | Quote

[EP]

bad idea to install it thru dism on 1903 though
MS should have put more “safeguards” to prevent that circumvention

Reply | Quote

[Microfix]

I usually only patch one device as a testbed, however, it’s been a busy day updating.
With system images done, and against the grain of the askwoody ethos, to hold off…
I’ve patched with no adverse issues on three Win8.1 Pro x64 and one Win7 Pro x86 device.
Local Pixma printer/ scanner working, no errors in event viewer and no further telemetry in either OS.
SFC reports no violations, (didn’t have time to do screenshots, take it or leave it)
Bring on February Patch Tuesday 🙂

W10, the itch you simply cannot scratch!

4 users thanked author for this post.

TaskForce141, jburk07, DrBonzo, PKCano

Reply | Quote

[DrBonzo]

@microfix – were you offered KB4535680, and if so, did you install it? Seems like it’s a stand-alone update for Win 8.1 and also some versions of Win 10 (there are a couple of posts above about it and Win 10).

I’m on Win 8.1 and I’m always pretty leery of stand-alone patches. I’m tempted to hide it since the way I read it, physical access is required to exploit the vulnerability.

Has anybody else dealt with it?

2 users thanked author for this post.

WCHS, Microfix

Reply | Quote

[Susan Bradley]

Yes in the patchmanagement.org venue it caused double reboots on hyperV as well as “paused” virtual machines.

Susan Bradley Patch Lady

1 user thanked author for this post.

DrBonzo

Reply | Quote

[Microfix]

@DrBonzo, yup kb4535680 was offered post CU patch kb4598285 installation via WU re-check.
Weighed around 90kb and installed it. No adverse effects here.

more info over on BleepingComputer

W10, the itch you simply cannot scratch!

Attachments:

You must be logged in to access attached files.

2 users thanked author for this post.

WCHS, DrBonzo

Reply | Quote

[WCHS]

If I am reading Bleeping Computer correctly, there is no advice to hide it (or avoid running it), although Susan at #2333320 says she would do so.

Any update on this advice?

1 user thanked author for this post.

DrBonzo

Reply | Quote

[anonymous]

Yes. Wait and see if the problems it causes are widespread.
It hasn’t been out long enough for your question yet, much less the answer to it. We are just beginning to get reports.
That is what the DEFCON system and Susan’s hesitancy is all about.

2 users thanked author for this post.

DrBonzo, WCHS

Reply | Quote

[Microfix]

that reads familiar, and wise for those who are unsure.

W10, the itch you simply cannot scratch!

2 users thanked author for this post.

DrBonzo, WCHS

Reply | Quote

[fracky]

Office 2011 has excel issue, still not resolved for 2012. We’re stuck to 2010 for the meantime I guess

Reply | Quote

[Susan Bradley]

What excel issue are you referring to?

Susan Bradley Patch Lady

Reply | Quote

[anonymous]

Hi, I have never done a feature update and am not a techie. On my windows 10 pro version 1909 I have used wushowhide and hid KB4535680. When time comes after installing January updates (KB4598229 and KB890830) can I upgrade to version 2004 with KB4535680 hidden?

Reply | Quote

[Susan Bradley]

Yes.

Susan Bradley Patch Lady

Reply | Quote

[EP]

note that KB4535680 update has some known issues

one of them is that some OEM firmware may block the KB4535680 update from installing and MS suggests contacting the firmware OEM for more info.

Reply | Quote

[JCpharm]

Does CU KB4598229 for version 1909 hold as well during MS- DEFCON 2 period?

Win10 Pro version 1909

Reply | Quote

[Microfix]

that should be ok to install as KB4598229 is from November 2019
scratch that, read the date wrong..HOLD!

W10, the itch you simply cannot scratch!

• This reply was modified 2 months, 4 weeks ago by Microfix.

1 user thanked author for this post.

JCpharm

Reply | Quote

[anonymous]

Hi there,

I’m using Win 10 Home version 1909 (I have not download and install Win 10 version 20H2 yet) and I have installed KB4535680, KB4598229 and KB890830 (only 3 appear ready to update). It was a slow update but then I noticed when I restart the computer after installing the updates that it shows in stages. It shows up as “Stage 1 out of 3” while it was configuring the update but doesn’t complete the rest of the stages (only completed the first stage), even after I restart the computer again and checking for updates but nothing comes out. In the days since then, I noticed that Windows Update doesn’t auto-check the updates every day and that I have to manually check for updates. I’m not sure whether or not this week’s Windows update has something got to do with not auto-checking updates on my computer. Or if there is something odd about my computer.

 

 

Also side note: I also noticed there’s a hidden update installed (KB4598479) on the same day. It didn’t show in the Update History and hasn’t featured in ghacks.net. I’m curious whether if there are errors to this hidden update and why this update is hidden

Reply | Quote

[Susan Bradley]

That’s a servicing stack update that installs at the same time as your main update.

What do you have your settings at?  Updates don’t come out every day.

Susan Bradley Patch Lady

Reply | Quote

[anonymous]

Hey Susan,

Thanks for your reply.

Normally I let my computer auto-check the updates daily to see if I have any updates that needs to download and install, you know letting me know that my computer is up-to-date and when it was last checked. I have not set to pause the updates and/or change active hours (I normally use the computer in the mornings). But somehow every morning when I check the Windows Update, it doesn’t auto-check the updates and so I have to manually check for updates

Reply | Quote

[Susan Bradley]

It may not show in the GUI that it’s checked for updates.  Is your defender a/v getting it’s updates in the background?

Susan Bradley Patch Lady

Reply | Quote

[anonymous]

Windows defender a/v is off for periodic scanning. I’m currently using Norton Security

Reply | Quote

[Paul T]

anonymous wrote:

it doesn’t auto-check the updates and so I have to manually check for updates

Checking manually is asking windows to “download and install everything”. This is not a good idea IMO.

To see if any new updates are available, download WuMgr and use it to check for updates (the circle icon). It will not install anything unless you tell it to.

cheers, Paul

Reply | Quote

[ClearThunder]

I was a glutton for punishment, so I updated my Win10 pro to 20H2. I didn’t block the driver updates correctly, so I got em’ all.  But at least everything still works. No issues since install.

The last .NET framework update was a joke.  I hope my machine won’t throw a fit if I uninstall it.

 

"Censorship is thought control" ----- Ronald Reagan

Reply | Quote

[geekdom]

If .NET Framework update causes no problems, leave it in place.

On Hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender TRV=1909 WuMgr
offline▸ Win10Pro 20H2.19042.685 x86 Atom N270 RAM2GB HDD WindowsDefender WuMgr GuineaPigVariant
online▸ Win10Pro 20H2.19042.804 x64 i5-9400 RAM16GB HDD Firefox86.0 WindowsDefender TRV=20H2 WuMgr

• This reply was modified 2 months, 4 weeks ago by geekdom.

Reply | Quote

[Alex5723]

Installed kb4598242 and kb890830 on Windows 10 20H2 (19042.746).
All is well.

Reply | Quote

[anonymous]

Win 10 Pro 1909 64 bit.  Downloaded SSU KB4598479 and January CU KB4598229 from MS Update Catalog, standalone installed OK, test machine stable for 2 days.  Preview .NET update and Secure Boot update not installed.

Reply | Quote

[EP]

Oh Susan

new preview updates were released this THU Jan. 21 for 1809 & 1909.

KB4598298 for v1909
https://support.microsoft.com/help/4598298

KB4598296 for v1809 Enterprise/Education & LTSC 2019
https://support.microsoft.com/help/4598296

those using v2004/20H2 may get their preview updates by the end of January

Reply | Quote

[anonymous]

I am running W8.1 x64 enterprise OS on an Asus Z87-PRO motherboard. I have KB4535680, the security update for secure boot DBX being offered on a standalone basis. I am a bit puzzled because the system is in legacy bios mode and secure boot is not supported. The update appears inapplicable and I was wondering if anyone might know why it is offered to install. Also, what would happen if installed; would the install just fail harmlessly or might there be a more troublesome result. Any info is much appreciated!

Reply | Quote

[anonymous]

You should hide KB4535680.
See https://www.askwoody.com/2021/security-update-for-secure-boot-dbx-can-be-skipped-kb4535680/

Reply | Quote

[Alex5723]

Microsoft released Microcode for 1809, 1903, 1909, 2004, 20H2, 21H1.

Microsoft released microcode updates, designed to protect Windows 10 systems against Spectre-based attacks, for Windows 10 version 1809, Windows 10 version 1903 and 1909, Windows 10 version 2004, 20H2 and 21H1 this week

Windows 10 version 2004, 20H2 and 21H1: KB4589212
Windows 10 version 1903 and 1909: KB4589211
Windows 10 version 1809: KB4589208

https://www.ghacks.net/2021/01/28/microsoft-releases-microcode-updates-for-windows-10-version-1809-and-newer/

[Moderator edit] please add a precis which gives details of the post content so readers can decide if it’s relevant to them

3 users thanked author for this post.

b, gamezenchill, Fred

Reply | Quote

[Author]

Posts