CONNECT WITH US

Microsoft Security Updates: January 2018

Microsoft Patch notes

File Attachment: January-2018

Due to the disclosure of Meltdown and Spectre, Microsoft released several patches last week with the ranking “Important.” While there are no active attacks against these vulnerabilities, a special focus should be placed on any of the browser patches, due to potential attacks using JavaScript.

It is important to note that OS-level and BIOS (microcode) patches that are designed to mitigate Meltdown and Spectre may lead to performance issues. It is important to test all patches before deploying.

Some of these updates are incompatible with third-party antivirus software, and may require updating AV on workstations and servers. Microsoft has released guidance documents for both Windows clients and servers. Windows Server requires registry changes in order to implement the protections added by the patches.

Microsoft has also halted the deployment of patches for some AMD systems, as there have been issues with systems after installation.

Aside from these patches, Microsoft has released patches covering 56 other vulnerabilities. Of these vulnerabilities, 16 are ranked as “Critical,” with 28 potentially leading to remote code execution.

For this release there are patches for both Microsoft Word and Outlook, which should also be prioritized for workstation-type devices. Most of the patches released are for browsers and involve the Scripting Engine. These patches should be prioritized  for systems that access the internet via a browser.

Patch priority ranking:

  1. CVE-2017-5753 – Bounds check bypass (Spectre)
  2. CVE-2017-5715 – Branch target injection (Spectre)
  3. CVE-2017-5754 – Rogue data cache load (Meltdown)
  4. CVE-2018-0793 – Outlook
  5. CVE-2018-0794 – Word
  6. (Multiple CVEs) – Browser patches (Scripting engine)

Adobe has released an update to Flash Player, and has given it a Priority of 2, meaning there are no active attacks, and future attacks are not imminent. Microsoft has ranked this vulnerability as Critical for systems that receive Flash updates through Microsoft.

The following Excel spreadsheet lists all security updates for all Microsoft products that the company released in January 2018.

Executive Summary
• Microsoft released security patches for all supported client and server versions of the Windows operating system.
• Security updates are also released for Microsoft Edge, Internet Explorer, Microsoft Office, SQL Server, .NET Framework, .NET Core, ASP.NET Core and Adobe Flash
• No critical updates for any supported version of Windows.
• Cumulative updates are only distributed to systems who did not install them earlier (released as out-of-bound patches on January 4).

Operating System Distribution
• Windows 7: 7 vulnerabilities of which 7 are rated important
• Windows 8.1: 10 vulnerabilities of which 10 are rated important
• Windows 10 version 1607: 11 vulnerabilities of which 11 are rated important
• Windows 10 version 1703: 11 vulnerabilities of which 11 are rated important
• Windows 10 version 1709: 11 vulnerabilities of which 11 are rated important

Windows Server products:
• Windows Server 2008: 7 vulnerabilities of which 7 are rated important
• Windows Server 2008 R2: 7 vulnerabilities of which 7 are rated important
• Windows Server 2012 and 2012 R2: 10 vulnerabilities of which 10 are rated important
• Windows Server 2016: 9 vulnerabilities of which 9 are rated important

Other Microsoft Products
• Internet Explorer 11: 2 vulnerabilities, 2 critical
• Microsoft Edge: 17 vulnerabilities, 14 critical, 3 important

Scale Your MSP
Picture of ProVal Technologies, Inc

ProVal Technologies, Inc

Categories

Get in touch today for MSP NOC Services!

They truly act as an extension of our team, providing the right consulting support exactly when we need it.

ProVal brings deep, hands-on knowledge of how ConnectWise PSA really works, combined with a thoughtful, consultative approach that sets them apart.

They listen first—both to understand our environment and who we are as an organization—and focus on finding the right solutions rather than pushing products. With strong command of best practices and experience across many MSP environments, they truly act as an extension of our team, providing the right consulting support exactly when we need it.

michael-lafond
Michael LaFond
ConnectWise Program Manager
New Charter Technologies

Microsoft Security Updates: January 2018

Microsoft Patch notes

I truly view ProVal as a partner and extension of my team, not as one of my vendors

When our NOC Manager left last fall we wanted to replace the position with an outsourced NOC to reduce headcount, and bring in an expert to both Labtech and our backup solutions. Bringing in ProVal Technologies was one of the best decisions we made last year and has paid for itself.During our first few monthly recurring Labtech admin meetings the ProVal team discovered incorrect settings and policies that were not applying correctly in our Labtech server. Things that we thought were automated and working were not. For example, there were multiple scripts and policies running but set to do nothing such as disk cleanup scripts. Cisco Umbrella was not configured correctly. Server alerting was not set right and the list went on.The backup team sends daily and weekly reports and updates that reduce my technicians time that we used to spend on backup or antivirus tickets that took forever and were tedious.ProVal also brings in great insights to our business and really cares about our success. They will frequently mention to me in meetings what new scripts they can import to make us more efficient or will schedule upgrades to our backups, Labtech, etc so I don’t have to worry. I truly view ProVal as a partner and extension of my team not as one of my vendors.

Chris-Warnick-Headshot
Chris Warnick
Vision Computer Solutions
Northville, MI

They will quickly become an extension of your team and your ROI will reflect the results

We have been a long time user of Labtech and had tried for many years to manage the product internally with no real success at the level we needed to make our solutions more efficient for our customers. Once we hired Vikram and his team at ProVal, it solved all our pain points with the product and we really felt like we were leveraging the tool as it was designed. If this sounds like you and it’s keeping you up at night, then you need these guys. They will quickly become an extension of your team and your ROI will reflect the results.

Bryan-Wolff-Headshot
Bryan Wolff
CEO, Wolff Logics LT Managed & Admin Services
Cedar Park, Texas

They work well, fast and on budget

We met Vikram from ProVal Tech at Gary Pica’s Shnizzfest a year ago. Vikram explained the advantage of having trained, certified personnel take care of our recent Automate implementation. Even though we had taken an implementation package from ConnectWise to start up the program, we felt many custom configurations we needed for our business were lacking. We hired ProVal Tech after Automate was installed to help us with this task. From sales to technicians everyone was professional and knowledgeable. Onboarding was simple, and well documented. Tools on the web were supplied while we did the work, and they allowed us to track what was done, and see the improvements in the environment. It was easy to reach any of the team members, for any concern or question – all answered with courtesy and smile. Once the work was finished, we were given some training and explanations, add to that documentation, about the work and the scripts and features added to the program. We have been happily working with Automate since then. We can only recommend this efficient team of people for any work into Automate: they work well, fast and on budget.

Ben-Prevost-Headshot
Ben Prevost
FarWeb IT
Sherbrooke, Canada
Copy link
CopyCopied