Replies

GeoffB wrote:

I am Win 7 x64 and use Google Chrome as my browser, with Flash disabled. Therefore, I assume I don’t need to do an update for Flash to overcome this exploit? appreciate advice on this. GeoffB

Google Chrome auto updates the flash player – see my blog post below how to check the version.

Adobe Flash Player version 30.0.0.113 available

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

2 users thanked author for this post.

jburk07, Elly

0patch is long in business and provided a couple of useful patches in the past (I’ve blogged several times about their solutions). If you are facing the situation that you can leave your machine vulnerable or closing the vulnerability but haven’t a network, then 0patch can be a solution – imho.

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

4 users thanked author for this post.

Cascadian, woody, Karlston, jburk07

For those having issues with a new logical drive (OEM or restore partition) after upgrade, I’ve published an article with workarounds

Windows 10 V1803 update creates a new OEM Partition

 

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

5 users thanked author for this post.

Mr. Natural, Elly, columbia2011, Microfix, woody

AFAIK the updates itself hasn’t changed. But MS has changed the KB descriptions. Some details here:

https://borncity.com/win/2018/04/05/windows-kb4090450-kb4088875-kb4088878-kb4088881/

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

8 users thanked author for this post.

abbodi86, Cascadian, AJNorth, SueW, Elly, GoneToPlaid, woody, Microfix

Just for your information. There ist a Critical flaw in MS Malware Protection Engine (CVE-2018-0986) that allows a remote code execution. Updates will be delivered within the next 24 hours to all affected products (Defender, MSE, Forefront, Exchange Server).

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

8 users thanked author for this post.

Laptop Boy, jburk07, AJNorth, HiFlyer, woody, MrBrian, Microfix, amraybt

Guess users of Windows 7 and Sever 2008 R2 are now sacked – the ne patches has nasty ‘known issues’ – and the old January 7 February (Meltdown) patches comes with a nasty surprise.

It seems, something went terribly wrong: January/February 2018 Meltdown patches from Microsoft opens even a bigger hole. No more exploit is necessary to access the memory from user processes (and even write it).

See Windows 7 Jan./Feb. 2018 patches opens Total Meltdown vulnerability

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

1 user thanked author for this post.

grayslady

It seems, something went terribly wrong: January/February 2018 Meltdown patches from Microsoft opens even a bigger hole. No more exploit is necessary to access the memory from user processes (and even write it).

See Windows 7 Jan./Feb. 2018 patches opens Total Meltdown vulnerability

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

8 users thanked author for this post.

Sessh, walker, geekdom, SueW, Elly, satrow, abbodi86, MrBrian

It seems, something went terribly wrong: January/February 2018 Meltdown patches from Microsoft opens even a bigger hole. No more exploit is necessary to access the memory from user processes (and even write it).

See Windows 7 Jan./Feb. 2018 patches opens Total Meltdown vulnerability

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

6 users thanked author for this post.

Steve, AlexEiffel, satrow, geekdom, MrBrian, radosuaf

Patch for IE 11 fixes crash on Win 7
Internet Explorer Update KB4096040 (March 23, 2018)

Preview Rollup Update for Windows 7 with many issues

Windows 7: Preview Rollup Update KB4088881 (03/23/2018)

To me, it seems that Windows 7 and Windows Server 2008 R2 users /admins are guinea pigs for Microsoft.

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

1 user thanked author for this post.

woody

Since posting the first edition of my blog article, I added some text (we have a discussion on German Facebook). Microsoft’s article Configure Windows diagnostic data in your organization from October 2017 contains contradictionary statements. What I read, was:

The Security level gathers only the diagnostic data info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server 2016, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windows IoT Core editions.

 

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

2 users thanked author for this post.

Norio, Elly

MrBrian wrote:

“They are usually uninstall-able” I wonder if you meant “They are usually not uninstall-able”?

That was what I also thought. I was to lazy to boot a W10 VM to double check the current ssu, but I’ve mentioned that uninstall thing within my blog post Windows 10 Version 1709: Servicing Stack Update KB4090914 (without mentions Susan’s contradictionary statement). I linked my blog post to the article explaining the trick, how to make a servicing stack update uninstallable. But after doing that, the system is ‘damaged’ and can’t be used to install further updates.

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

Welcome at askwoody

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

3 users thanked author for this post.

AlexEiffel, Elly, SueW

abbodi86 wrote:

Microsoft Update Catalog is not broken catalog.update.microsoft.com is the IE-activex front-end http://www.catalog.update.microsoft.com is the non-activex front-end (for IE and other browsers)

That’s what also some German users told me, but …

I mentioned it within my German comment – just try the two tests below.
http://www.catalog.update.microsoft.com
catalog.update.microsoft.com

The last link shows ‘Server negotiated HTTP/2 with blacklisted suite’ (btw also for IE 11 and Edge under Windows 10). I would say, it’s some misconfigured servers, probably.

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

3 users thanked author for this post.

ch100, woody, abbodi86

I guess, the risk for private user is minimal. But it’s probably an attack vector, that should be discussed at least.

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

1 user thanked author for this post.

HiFlyer

See my addendum one post above. It seeems that you altered a cab file.

Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

https://www.borncity.com/win/

4 users thanked author for this post.

AlexEiffel, Cascadian, MrBrian, woody