Newsletter Archives

• Patching that video card

  Posted on November 18, 2024 at 02:42 CST by Susan Bradley • Comment in the Forums

  PATCH WATCH

  

  By Susan Bradley

  This month, I want you to review what else you have installed on your computer besides the operating system.

  Why? Because I want you to focus on your browsers and the software that is installed with your video card.

  And why video cards? Because there have been several vulnerabilities specifically tied to the Windows graphics drivers released by NVIDIA.

  Read the full story in our Plus Newsletter (21.47.0, 2024-11-18).

  Patch Watch AirPods, AirPods Pro 2, CVE-2024-0117, CVE-2024-0118, CVE-2024-0119, CVE-2024-0120, CVE-2024-0121, CVE-2024-43451, CVE-2024-43639, Exchange Server, HP Support Assistant, KB5046613, KB5046633, Newsletters, NVIDIA, Patch Lady Posts

• MS-DEFCON 4: A “sort of” quiet February

  Posted on February 27, 2024 at 02:45 CST by Susan Bradley • Comment in the Forums

  

  ISSUE 21.09.1 • 2024-02-27

  

  By Susan Bradley

  The February updates have generally been well behaved, with one major exception: gamers.

  Otherwise, things have been mostly quiet. That’s why I feel comfortable lowering the MS-DEFCON level to 4. Patches are unlikely to cause most users any problems.

  Anyone can read the full MS-DEFCON Alert (21.09.1, 2024-02-27).

  AskWoody Plus Alert, MS-DEFCON .NET patches, Alerts, ConnectWise, Exchange Server, KB5034441, KB5034763, KB5034765, MS-DEFCON, MS-DEFCON 4, Patch Lady Posts, ScreenConnect, SQL Server, WinRE

• A new patching year

  Posted on January 8, 2024 at 02:43 CST by Susan Bradley • Comment in the Forums

  PATCH WATCH

  

  By Susan Bradley

  Tomorrow, as usual, Microsoft will release the January patches.

  Today, as usual, I’m recommending that you not install the patches right away. If you’ve been dealing with and following patching as long as I have, you’ll know that it takes about a week or so for problems to bubble up.

  Side effects are somewhat sporadic — some see them, some don’t. Those who see none sometimes move along to the next vulnerability. Lately, however, Microsoft has been taking a long-term look at vulnerabilities thus and taking several months to implement changes. 2024 looks to be no different, with many long-term issues needing resolution.

  This week’s edition of Patch Watch focuses specifically on business patching and what we may see in the coming months. For consumers, you probably will not have the same side effects or concerns as business patchers.

  Read the full story in our Plus Newsletter (21.02.0, 2024-01-08).

  Patch Watch CVE-2021-42291, CVE-2023-24932, Exchange Server, KB5008383, KB5025885, Newsletters, NTLM, Patch Lady Posts, Secure Boot

• MS-DEFCON 3: Patch carefully

  Posted on August 22, 2023 at 02:45 CDT by Susan Bradley • Comment in the Forums

  

  ISSUE 20.34.1 • 2023-08-22

  

  By Susan Bradley

  August can be a weird month where patching is concerned.

  I’m lowering the MS-DEFCON level, but with caution. I usually hope to give time near the end of the month for patches to be applied, by lowering the level to 4 and sometimes 5. This time, I’m wishy-washy. Caution is the order of the day, so I’m lowering the level to just 3.

  In my house, August represents a tradition — things occur that make me think technology wants to take a vacation, just like the rest of us.

  Anyone can read the full MS-DEFCON Alert (20.34.1, 2023-08-22).

  AskWoody Plus Alert, MS-DEFCON Alerts, CVE-2022-40982, CVE-2023-32019, Exchange Server, MS-DEFCON, MS-DEFCON 3, Patch Lady Posts, USB Security Key, Windows Update

• May’s messy updates

  Posted on May 15, 2023 at 02:42 CDT by Susan Bradley • Comment in the Forums

  PATCH WATCH

  

  By Susan Bradley

  Although the May releases for both Windows and Apple have not introduced side effects or hiccups so far, they haven’t been as problem-free as they should have been.

  Apple released the first of its “rapid response” updates, announced last June and supposedly allowing the company to deploy important security-only software updates without demanding a reboot.

  Read the full story in our Plus Newsletter (20.20.0, 2023-05-15).

  Patch Watch Apple, Exchange Server, Newsletters, Patch Lady Posts, Rapid Security Responses, Secure Boot, Windows 10

• MS-DEFCON 2: Prepare for April showers

  Posted on April 6, 2023 at 02:45 CDT by Susan Bradley • Comment in the Forums

  

  ISSUE 20.14.1 • 2023-04-06

  

  By Susan Bradley

  The next round of updates is coming soon and may be confusing.

  For one thing, it now appears that Windows 10 and Windows 11 updates will diverge. That is reason enough for me to raise the MS-DEFCON level to 2.

  Any confusion instantly causes me to recommend deferring updates.

  It does not appear that the forthcoming updates for Windows 10 will introduce any changes. They will include only security patches. Microsoft stated:

  After March 2023, there are no more optional, non-security preview releases for the supported editions of Windows 10, version 20H2 and Windows 10, version 21H2. Only monthly security update releases will continue for these versions.

  Anyone can read the full MS-DEFCON Alert (20.14.1, 2023-04-06).

  AskWoody Plus Alert, MS-DEFCON Alerts, Exchange Server, Microsoft Store, MS-DEFCON, MS-DEFCON 2, Patch Lady Posts, Snipping Tool, Windows, Windows 10, Windows 11

• The sky is not falling

  Posted on March 20, 2023 at 02:41 CDT by Susan Bradley • Comment in the Forums

  PATCH WATCH

  

  By Susan Bradley

  You may have seen the headlines: Outlook is getting a patch for a zero-day attack that can’t be fixed just by turning off the preview pane.

  Don’t panic. The risk is greatest if you are connecting Outlook to an on-premises Exchange server.

  Importantly, the attacks have been seen only in targeted firms. The risk is higher for government agencies. Microsoft has even provided a script to determine whether you are at risk.

  Read the full story in our Plus Newsletter (20.12.0, 2023-03-20).

  Patch Watch Exchange Server, Microsoft Outlook, Newsletters, Patch Lady Posts, Patch Watch

• MS-DEFCON 4: Wrapping up a short month

  Posted on February 28, 2023 at 02:45 CST by Susan Bradley • Comment in the Forums

  

  ISSUE 20.09.1 • 2023-02-28

  

  By Susan Bradley

  February’s patches affected you either severely, or not at all.

  The good news: If you are a consumer, home user, or business that does not use Windows Server 2022 or any version of on-premises Exchange server, you will be just fine installing the updates at this time. Therefore, I am very comfortable with lowering the MS-DEFCON level to 4.

  However, if you are a business patcher with Windows Server 2022 hosted in VMware, you may have been significantly impacted. In addition, patch administrators are still dealing with the side effects of the Exchange updates.

  Anyone can read the full MS-DEFCON Alert (20.09.1, 2023-02-28).

  AskWoody Plus Alert, MS-DEFCON Alerts, Exchange Server, MS-DEFCON, MS-DEFCON 4, VMWare, Windows Server 2022, Windows Update, Windows Update block

• January’s patching cyclone

  Posted on January 16, 2023 at 02:42 CST by Susan Bradley • Comment in the Forums

  PATCH WATCH

  

  By Susan Bradley

  We’re a bit soggy and wet at the AskWoody Tech LLC Global Headquarters here in central California.

  We’ve had nearly a week of rain, and more is coming. I shouldn’t complain — severe drought has brought our state’s water supply down to historically low levels, so the water is needed and much appreciated. But when Microsoft rains down upon us at the same time, the total deluge is a bit much.

  For January, Microsoft fixed 98 security vulnerabilities, said goodbye (for the final time) to the much-beloved Windows 7, also said goodbye to the less used (but popular among its buffs) Windows 8.1, and actually released updates to Microsoft’s on-premises mail server, Exchange.

  Read the full story in our Plus Newsletter (20.03.0, 2023-01-16).

  Patch Watch Exchange Server, Newsletters, Patch Lady Posts, Patch Watch, Windows 7, Windows 8

• Dealing with printers

  Posted on March 22, 2021 at 01:00 CDT by Susan Bradley • Comment in the Forums

  PATCH WATCH

  

  By Susan Bradley

  Keeping printers up to date

  Once upon a time, I purchased an HP LaserJet 4L printer that would just keep on printing, year after year, until the plastic door on the top of the printer finally broke off. After my initial installation, the printer driver was never updated.

  Read the full story in the AskWoody Plus Newsletter 18.11.0 (2021-03-22).

  AskWoody Plus Newsletter, Patch Watch AskWoody Plus Newsletter, Blue screens of death, Exchange Server, Patch Lady Posts, Printers

• MS-DEFCON 2 — It’s time to defer March updates

  Posted on March 8, 2021 at 14:45 CST by Susan Bradley • Comment in the Forums

  ISSUE 18.9.1 • 2021-03-08

  

  

  By Susan Bradley

  It’s the start of the patching week.

  We are a day away from the official start of patching season. While Microsoft started the March patching madness early, with a critical patch needed for its mail servers, we have yet to see what’s in store for those of us that merely use their Windows as workstations.

  Read the full story in the AskWoody Plus Alert 18.9.1 (2021-03-08).
  Learn more about MS-DEFCON!

  AskWoody Plus Newsletter, Windows Patches/Security AskWoody Plus Newsletter, Exchange Server, MS-DEFCON 2

• Exchange Server elevation of privilege bug acknowledged

  Posted on February 6, 2019 at 12:04 CST by woody • Comment in the Forums

  Remember the 0day exploit in Microsoft Exchange that we talked about two weeks ago?

  As I suspected, your Exchange Server is only vulnerable to a man-in-the-middle attack. It isn’t an all-purpose attack: The miscreant has to be able to sit in the middle of an interaction with the Server.

  Microsoft finally has an explanation in ADV190007 | Guidance for “PrivExchange” Elevation of Privilege Vulnerability.

  A planned update is in development. If you determine that your system is at high risk then you should evaluate the proposed workaround.

  The workaround is a one-line PowerShell script that @b talked about last week.

  Windows Patches/Security 0day, Exchange Server, PrivExchange