|
MS-DEFCON 2:
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it.
|
-
May 2019 Patch Tuesday arrives
Posted on Comment on the AskWoody Lounge- This topic has 112 replies, 32 voices, and was last updated 1 year, 7 months ago.
Viewing 43 reply threads-
-
The numbers are starting to roll in. Hang on a sec while we get a clearer picture.
[See the full post at: May 2019 Patch Tuesday arrives] -
Wow. If they released a patch for Windows XP, then this vulnerability must be really bad.
1 user thanked author for this post.
-
How come Windows Update MiniTool, Windows Update Management, Belarc Advisor still doesn’t show May 2019 updates for 1809 Pro 17763.437 ?
1 user thanked author for this post.
-
-
Direct Catalog downloads for Group B Security-only patches and IE11 Cumulative Updates have been updated on AKB2000003 on 5/14/2019.
Please note: There was a pciclearstalecache.exe bundled with the Win7 May Security-only Update. The download link has been included in AKB2000003.
For those of you with Win7:
Download the pciclearstalecache file and store it in the same location as the Security-only Update (on the desktop, in a folder, etc). Do not execute the file directly. When you install the Security-only Update, it should execute the pciclearstalecache automatically in the process. You may see the brief flash of a command prompt.
(At least, this is the way it worked when bundled with the Monthly Rollup last year.)-
-
-
See the note above on how to deal with it.
1 user thanked author for this post.
-
-
-
-
the last security only update I installed was the April 2019: KB 409310.
??? The April 2019 Security-only Update for Win7 was KB4493448 (as shown in the attachment).
I don’t see anything for the pciclearstalecache file.
Instructions are here #1621530.
3 users thanked author for this post.
-
-
-
-
Ouch.. I didn’t see any command prompt.
Btw the file from the catalog was called (I didn’t remove the SHA1 tho..):
pciclearstalecache_d243a607b50db10ed50f03cff570498018c61a59.exeChecking the registry, then, I noticed some errors.
- Since years I use SoftwareRestrictionPolicies to limit cmd.exe to be used only with admin rights, due to the fear of ransomware.
It never created problem with patches, but now I saw an entry about it:
Access to C:\Windows\system32\cmd.exe has been restricted [..] - Also:
The winlogon notification subscriber <TrustedInstaller> is taking long time to handle the notification event (CreateSession).
The winlogon notification subscriber <TrustedInstaller> failed a critical notification event.
Is there a more detailed log somewhere?
(I’ve found windowsupdate.log, but I can’t understand anything lol)Should I reinstall the patches? :\
-
This reply was modified 1 year, 8 months ago by
.
- Since years I use SoftwareRestrictionPolicies to limit cmd.exe to be used only with admin rights, due to the fear of ransomware.
-
@PKCano… “When you install the Security-only Update, it should execute the pciclearstalecache automatically in the process. You may see the brief flash of a command prompt.
To verify the patching process actually completed successfully, after restarting the computer when the update completes the “pci.sys” file located in the Windows\System32\Drivers folder will change.
Before the update is ran the file version is 6.1.7601.24056 with a date stamp of 2/10/2018. After a successful installation the file version will be 6.1.7601.24441 with a date stamp of 4/18/2019.
1 user thanked author for this post.
-
Thank you for confirming that there is a change, and what others may look for, specifically, when the updating is successfully completed.
I remembered being able to look for a similar change, last year, but had difficulty bringing up the specific reference.
Those that do not see a change may not have downloaded both files and placed them in the same folder, thus not installing correctly.
The ‘pci.sys’ file is something that Everything search will find much quicker than the Windows Search, or trying to navigate to it, with Windows Explorer, from my experience.
I do wish that some others could confirm this date change, as well.
Non-techy Win 10 Pro and Linux Mint experimenter
1 user thanked author for this post.
-
I can confirm – sort of. Here’s what happened to me on a handful of Win 7 machines, all of which were up to date with Group B through April patches. Each had a file version 6.1.7601.24056 before the May Security Only. I downloaded the SO file from the Update Catalog and it came in a folder that also had the pci….exe file in it. The pci…exe file did NOT execute when I installed the SO (not only did I not see the command line ‘flash’ but the file version did not change). I assumed per PKCano that it did not execute because it did not need to execute. Nonetheless I then executed the pci…exe file separately and got the 6.1.7601.24441 file version. Everything has been working fine on all the machines for almost 3 days now.
1 user thanked author for this post.
-
I know you asked for “Others” to confirm this Elly and theoretically that would omit myself, BUT. I’ve completed the update process on all 16 computers now with 12 of them being 64 bit and the other 4 being 32 bit and got the exact same result from each of them.
To be specific… on each computer I started by verifying the “pci.sys” file was dated 2/10/2018 and then created a folder on the Desktop & named the new folder Patches (the folder’s name doesn’t matter). I then downloaded KB4499175, KB4498206 and the pciclearstalecache files from the catalog using the links on the Group B page here at Woody’s and saved all three files to the newly created Patches folder.
I then made sure the Windows Update service was NOT running and double clicked on KB4499175 to launch the installation, and closed the opened folder once it started. When the installation finished I had the options to Restart or Cancel… I chose Cancel. I then went back to Services again and STOPPED the Windows Update service. Then I opened the Patches folder again and double clicked on KB4498206 to launch the installation, and closed the opened folder once it started. When the installation finished I had the options to Restart or Cancel again… this time I chose Restart.
Not once during the installations on any of 16 of the computers did I see a “blink”, a “command prompt box” or anything unusual take place during the installation processes. After the computers restarted I checked the “pci.sys” file again and every one is now dated 4/18/2019.
1 user thanked author for this post.
-
Alright! Other computers works as ‘others’ as far as I’m concerned!
It is helpful to have the exact steps for your success detailed, for those who have been uncertain about it working… so thank you, @Ed.
Non-techy Win 10 Pro and Linux Mint experimenter
-
-
-
-
-
-
The numbers are starting to roll in. Hang on a sec while we get a clearer picture.
[See the full post at: May 2019 Patch Tuesday arrives]Martin Brinkmann has full details on May 2019 updates
https://www.ghacks.net/2019/05/14/microsoft-windows-security-updates-may-2019-overview/
-
Big news is the “wormable” security hole in RDP, CVE-2019-0708. From Simon Pope on the MSRC Technet blogt:
Any future malware that exploits this vulnerability could propagate from vulnerable computer to vulnerable computer in a similar way as the WannaCry malware spread across the globe in 2017. While we have observed no exploitation of this vulnerability, it is highly likely that malicious actors will write an exploit for this vulnerability and incorporate it into their malware.
Vulnerable in-support systems include Windows 7, Windows Server 2008 R2, and Windows Server 2008. Downloads for in-support versions of Windows can be found in the Microsoft Security Update Guide. Customers who use an in-support version of Windows and have automatic updates enabled are automatically protected.
Out-of-support systems include Windows 2003 and Windows XP. If you are on an out-of-support version, the best way to address this vulnerability is to upgrade to the latest version of Windows. Even so, we are making fixes available for these out-of-support versions of Windows in KB4500705.
Interesting that in that “quote” you skipped over the “patch A.S.A.P.” bit:
Now that I have your attention, it is important that affected systems are patched as quickly as possible to prevent such a scenario from happening. In response, we are taking the unusual step of providing a security update for all customers to protect Windows platforms, including some out-of-support versions of Windows.
You feel the Director of Incident Response, Microsoft Security Response Center got that wrong?
-
-
-
Not wrong. But I prefer to see what kinds of problems kick up before somebody releases an attack into the wild.
You won’t be updating your test Windows 7 system yet? Someone needs to!
UPDATE: Remember that MS17-010, the WannaCry patch, appeared six weeks before there was a credible WannaCry threat.
By which time hundreds of thousands of Windows 7 computers were infected with ransomware.
Let’s hope the attackers remember to include a kill switch which can be inadvertently discovered again or it could be even worse.
Although there are many millions fewer Windows 7 systems now than there were two years ago during WannaCry.
I don’t doubt that this will be exploited. But at this point I’m concerned that there may be gotchas, including the Krebs report of having to install the patch twice.
Windows 10 patches for 1809 and 1903 may install twice, but Windows 10 isn’t affected by the “RDS worm”. So that Krebs report is unconnected with a forthcoming exploit.
1 user thanked author for this post.
-
-
-
-
best to wait until woody & susan give the all clear to install any net .NET patches
1 user thanked author for this post.
-
-
Group B patching recommends updating .NET through what is offered in Windows Updates. Refer to AKB2000003, which is the guideline for Group B patching.
1 user thanked author for this post.
-
-
-
-
-
Well, another Intel security bug was found. https://www.chromium.org/Home/chromium-security/mds
Looks like it’s another Spectre type of attack (if I read the info I found correctly so far, it attacks the buffers to retrieve sensitive data. Still reading.) and Microsoft added them in to all May 2019 patches (I can confirm it in 1903’s patch notes). Intel is rolling out microcode as well.
And just when you thought this would be over soon…
Quick Edit: Quick clarification: This is a cocktail of 4 bugs in the processors:
Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
The first three are considered Medium in severity. The last one is low.
-
This reply was modified 1 year, 8 months ago by
-
This reply was modified 1 year, 8 months ago by
-
KB 4494441 [that’s the Win10 1809 patch] had to be installed twice so be sure to run Windows Update twice. I was not amused.
Unlike Krebs, I only had to install once from WU on steady old Win8.1 x64 😛
KB4499151 May 2019 SMQR: error code 0x0
KB4497932 May 2019 Abode Flash Player: error code 0x0
no errors in event viewer post reboot.Confidence is high: I removed replaced WinSxS assemblies and
WinSxS temp files, oops, no going back!! 😉
No problem can be solved from the same level of consciousness that created IT- AE1 user thanked author for this post.
-
I had 2 W10 Pro computers that still had 1803 on them and this morning 1 of them updated before 10 am PST and got 1809 17763.475, the other one updated after 10 am PST and got 1809 17763.503.
Don't take yourself so seriously, no one else does 🙂
4 Win 10 Pro at 1909 (3 Desktops, 1 Laptop).1 user thanked author for this post.
-
In his post, Woody wrote that…
Big news is the “wormable” security hole in RDP, CVE-2019-0708. From Simon Pope on the MSRC Technet blog
It’s odd that XP and Windows 7 would be affected by this vuln, but not Vista which came out in-between those two.
Could this be an oversight on their part?
-
Excellent question. I have no idea.
1 user thanked author for this post.
-
Server 2008 is affected. So Vista has to be affected too as they share the same codebase.
1 user thanked author for this post.
-
-
But wait. That’s not all. There’s also a big hole in .NET versions 2.1 and 2.2. CVE-2019-0982. It’s a Denial of Service vulnerability.
To clarify, that’s .NET Core 2.1 and .NET Core 2.2 — not .NET Framework.
2 users thanked author for this post.
-
What a .NET mess
1 user thanked author for this post.
-
-
Customers running Windows 8 and Windows 10 are not affected by this vulnerability, and it is no coincidence that later versions of Windows are unaffected. Microsoft invests heavily in strengthening the security of its products, often through major architectural improvements that are not possible to backport to earlier versions of Windows.
Prevent a worm by updating Remote Desktop Services (CVE-2019-0708)
-
-
You would think for once microsoft would offer the remote desktop patch as a standalone update given the seriousness of it because now we have to accept the whole lot to patch this hole yet risk the update messing up something else. Which is particularly likely this month with these new MDS vulnerabilities being patched and what on earth is that going to do to performance? It’s just too early to install, a lot of us have been burned in the past doing that.
-
I seem to have well-behaved and pretty standard computer hardware (see * below).
On Tuesday May 14th, 16:00 Seattle time, I ran [Check for updates] and was offered 3 “Quality updates” for my Windows 10/64 Home:
KB4494441
KB4497932
KB4499405
(Yes, yes, I do have a previous full disk image, just in case.)Well, the grass is still thriving and just as green as on the other side. IOW, I found no problems, no issues and I now run Windows 10 Home version 1809 OS build 17763.503 (installed 15 May 2019 01:00, Antwerp time
).Fish are jumping and the cotton is high …
*
Motherboard Clevo P17SM-A
Intel(R) Core(TM) i7-4810MQ CPU
BIOS American Megatrends Inc. 4.6.5, 28/07/2015
32 GB RAM
Windows 10/64 Home
Samsung SSD 840 EVO 500 GB mSATA
HDD 1 TB
Intel(R) HD Graphics 4600
NVIDIA GeForce GTX 970M
Realtek PCIe GBE Family Controller
Telenet broadband @ 192 Mbps
7 USB 3.0 external HDDs 17 TB total
1 eSATA external HDD 1 TB for system disk images
-
This reply was modified 1 year, 8 months ago by
-
This reply was modified 1 year, 8 months ago by
-
wonder what the Google-DEFCON is then
Microarchitectural Data Sampling (MDS) attacks affects ALL modern Intel CPUs. My Intel i7-8850H looks like Swiss cheese.
Both Microsoft (Intel) and Canonical issued micro-code updates).
You can download MDS tool for Windows, Linux.
https://mdsattacks.com/ (scroll down for the tool)
1 user thanked author for this post.
-
-
-
Bravo! Top job Microsoft. Security patches by the truckload (fine), and also an HSTS change you sneaked in with no notice which just made a number of websites inaccessible to those installing the patches … less than a week before an election.
🤦♂️
1 user thanked author for this post.
-
-
Sorry missed the reply.
After some testing, any of the May 2019 cumulative patches for Windows 8.1 and 10 with HSTS. The one affecting my client is KB4499167. For Windows 7 specifically KB4498206, which also included in the rollups KB4499164 and KB4499175 for Windows 7.
“gov.uk” is the main site for the UK government. It’s used for online applications for car tax, passports, driving licenses. That sort of very important stuff which requires a secure connection, and has been HTTPS for years.
Then you get a level down to local government, where there’s 400+ local councils. They have placename.gov.uk domains, which this just broke as we got no warning that HSTS was being enforced. I’m an infrastructure tech for for a local council with 250,000 residents. A bunch of internal systems (that don’t require HTTPS) stopped working after I got the patches to test on Wednesday morning.
For us it prevents access to the publicly accessible democracy data and the planning system among others. Both of these are maintained by external systems providers so it’s not a five minute job to add a certificate. The main website is fine for us, other councils don’t even have HTTPS enabled on those. I got a tweet before from someone advising that reading.gov.uk and doncaster.gov.uk are inaccessible.
I can cancel or delay the patch to our internal clients, but we’ve got zero control over the patching on customers machines. Yes, we can advise them to use Chrome, Firefox etc, but it still going to generate a significant load on customer services.
-
This reply was modified 1 year, 8 months ago by
-
This reply was modified 1 year, 8 months ago by
-
-
That article addresses it as a Windows 10-only issue.
1 user thanked author for this post.
-
-
-
-
-
What’s shown as “workaround” there is the cause, not a cure.
It’s now listed as a known issue in May updates for Windows 7/8.1/10 (all versions).
Bleeping Computer seems to have the best summary, along with examples of a few county/town sites affected: Some GOV.UK Sites Unreachable Due to HSTS Changes in Windows Updates
(Includes a link to “not recommended” registry fixes for Windows 7 and 8.1, but not Windows 10.)
The issue only affects Internet Explorer and Edge (original) though, not other browsers including Edge (Chromium).
1 user thanked author for this post.
-
-
-
-
-
The instructions for the installation are here. Follow those instructions. They explain what is needed.
-
-
-
-
Please read the instructions provided. The pci file is NOT in the update. There are two (2) files. Follow the link to AKB2000003 – see the two files. Download the two (2) files as instructed. Install them as instructed. The instructions above are very clear. There is even a screenshot a few posts below. Look at the picture. See the red arrow point at the second file.
1 user thanked author for this post.
-
-
Please quote for me here what is says about the pciclearstalecache file in these instructions.
1 user thanked author for this post.
-
Hey, PKCano,
I’m just restating your instructions, but giving them three steps… maybe that will help those still having problems understanding them.
1) Download the pciclearstalecache file and store it in the same location as the Security-only Update (on the desktop, in a folder, etc).
2) Do not execute the file directly.
3) When you install the Security-only Update, it should execute the pciclearstalecache automatically in the process.
PS- Folks- you do have to actually read the instructions and follow them. If you continue to have problems, it might be best to move to Group A, and let Windows Update handle this for you.
Non-techy Win 10 Pro and Linux Mint experimenter
-
-
-
-
-
-
-
The Security-only patch KB4499175 is contained in the Monthly Rollup KB4499164. You DO NOT need both.
3 users thanked author for this post.
-
-
-
-
-
Your settings are telling it not to show up for 21 days.
1 user thanked author for this post.
-
-
-
-
The pciclearstalecache file should be in the same location(folder) as KB4499175. You install the Security-only update as usual, and if the .exe file needs to run, it will do so automatically during the SO install. You may or may not see the command prompt box flash. It the .exe does not need to run, it will not do so. So other than downloading it to the same location as the SO, you do not need to deal with it.
-
This reply was modified 1 year, 8 months ago by
1 user thanked author for this post.
-
This reply was modified 1 year, 8 months ago by
-
-
-
You should not be putting anything in c:\Windows\SoftwardDistribution\Download.
If you have already installed KB4499175 the point is moot.
If you have not installed KB4499175, then when you download pciclearstalecache, you should save it to the same folder/location that KB4499175 is in. You have to download two files. Then install KB4499175 as described.-
This reply was modified 1 year, 8 months ago by
1 user thanked author for this post.
-
This reply was modified 1 year, 8 months ago by
-
-
And Microsoft has released even NEWER updates but only for the 1803 & 1809 versions of Windows 10 this Tuesday May 21.
KB4497934 for 1809 (build 17763.529):
https://support.microsoft.com/en-us/help/4497934/windows-10-update-kb4497934KB4499183 for 1803 (build 17134.799):
https://support.microsoft.com/en-us/help/4499183/windows-10-update-kb4499183Important quotes from those articles about these new updates:
Starting with update KB4497934, we are introducing functionality that allows you to decide when to install a feature update. You control when you get a feature update while simultaneously keeping your devices up to date. Feature updates that are available for eligible devices will appear in a separate module on the Windows Update page (Settings > Update & Security > Windows Update). If you would like to get an available update right away, select Download and install now.
Starting with update KB4499183, we are introducing functionality that allows you to decide when to install a feature update. You control when you get a feature update while simultaneously keeping your devices up to date. Feature updates that are available for eligible devices will appear in a separate module on the Windows Update page (Settings > Update & Security > Windows Update). If you would like to get an available update right away, select Download and install now.
-
-
-
-
Evidently it was not needed in your case.
1 user thanked author for this post.
-
-
Viewing 43 reply threads
Welcome to our unique respite from the madness.
It's easy to post questions about Windows 10, Win8.1, Win7, Surface, Office, or browse through our Forums. Post anonymously or register for greater privileges. Keep it civil, please: Decorous Lounge rules strictly enforced. Questions? Contact Customer Support.
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments. Click here for details and to sign up.
Recent Replies
dmitriy1980 on Hard Drive at 100% usage
7 minutes ago- 23 minutes ago
- 25 minutes ago
mn-- on Laptop with home and work networks
27 minutes ago- 40 minutes ago
Tony H on Which version of MS Office should we buy and where can we get it?
43 minutes agoRoger on Which version of MS Office should we buy and where can we get it?
53 minutes agoDrcard:)) on How to put a picture ("Avatar") on your replies
54 minutes agoOscarCP on Apple to block sideloading iOS apps on M1
1 hour, 30 minutes agoMele20 on Giving you the choice
1 hour, 45 minutes agoWSila on Laptop with home and work networks
1 hour, 52 minutes ago- 1 hour, 53 minutes ago
- 2 hours, 14 minutes ago
- 3 hours, 29 minutes ago
Alex5723 on Iphone updating to new version when auto updates turned off?
3 hours, 43 minutes agodoriel on What Linux is and why it has persisted
3 hours, 49 minutes agoPaul T on So I opened up an HP and where’s the hard drive?
3 hours, 58 minutes ago- 3 hours, 58 minutes ago
- 4 hours, 7 minutes ago
- 4 hours, 9 minutes ago
- 4 hours, 9 minutes ago
- 4 hours, 43 minutes ago
- 4 hours, 44 minutes ago
b on Hard Drive at 100% usage
4 hours, 57 minutes agoMicrofix on Winaero Tweaker with W10 Improvements
5 hours, 16 minutes agoMoonshine on Using Windows 10 Backup Option
5 hours, 21 minutes ago- 5 hours, 45 minutes ago
- 5 hours, 47 minutes ago
- 5 hours, 59 minutes ago
- 6 hours, 1 minute ago