February 9th 2016 Windows Security Update Release Summary

[Brink]

Today we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released.

More information about this month’s security updates and advisories can be found in the Security TechNet Library.

MSRC Team

Source: February 2016 Security Update Release Summary - Microsoft Security Response Center - Site Home - TechNet Blogs


See also:

• Microsoft Security Bulletin Summary for February 2016
• Security Advisories 2016

 

[Swizz]

As always... thank you, Brink!

 

[ThrashZone]

Yep this is what I show
Took it after someone on M$ Community said our friend kb3035583 was showing with them
The 1 optional is SilverFish

 

[Swizz]

I'm curious when I open my current Windows Update I see that one box, which is the second one down, has no tick in the box. I have never seen that before. Can somebody please tell me the reason behind that? I mean I can click on the box itself and what have you, but I was just wondering.

Cheers.

 

[Anak]

Dialog between Susan Bradley and Doug Neal:

From: 'RE: should I concentrate on patching my webservers first' - MARC

"Although we don't generally use the word 'throttling' externally, that's exactly what \
this is. An unchecked update in the WUapp (Windows Update Control Panel applet) is \
an indication of an update that's being throttled (publicly called, "gradually \
releasing update x over a period of time"). This only affects the consumer \
scenarios: automatic update (AU) and Windows/Microsoft Update (WU/MU). And usually \
only the tech savvy folks would see it since they would need to open WUapp, see the \
update and notice it's unchecked). Enterprise scenarios (WSUS, SMS, SCCM, SBS, SCE, \
MBSA) and the MU Catalog are not affected since there's no concept of throttling \
(local admins like you have this control).

Updates are generally throttled when they are (a) major releases that need to be \
gradually deployed (like a major version upgrade for Internet Explorer), (b) when \
there are potential quality issues found in the first day or two of release (so we \
can slow the deployment while we gather data to assess the scope of an issue), or - \
as in this case - (c) we don't want to hit every Windows consumer PC on the planet \
at an inopportune time (like during the holidays) - but still give tech-savvy admins \
the ability to release the update (through WSUS/SMS/SCCM or by checking the box in \
WUapp).

A throttled update can be seen in the LOGs as the "regulation server" not permitting \
the download of the update. Of course, if you interactively check the checkbox in \
WUapp, you will circumvent the regulation server (throttling) and receive the update \
anyway. "

doug neal
Microsoft Update (MU)

More:
Why are some important Windows Updates not checked automatically?

 

[ThrashZone]

Short version
Net framework 4.6.1 is a Recommended update not a Important update
If your update settings were like this it would not be listed in the Important section

 

[sobranie]

Do we have a definitive list of which MS updates that should be avoided like the plague please?
Yeah, I know, .... all of them maybe, but just thought I'd ask.

 

[maxseven]

I'm curious when I open my current Windows Update I see that one box, which is the second one down, has no tick in the box. I have never seen that before. Can somebody please tell me the reason behind that? I mean I can click on the box itself and what have you, but I was just wondering.

Not sure why yours is unchecked--I installed that a couple of weeks ago.

FWIW the two we need be wary of re: Windows 10 are these:

KB2952664 This update helps Microsoft make improvements to the current operating system in order to ease the upgrade experience to the latest version of Windows.

KB3123862 The update adds capabilities to some computers that lets users easily learn about Windows 10 or start an upgrade to Windows 10.

But KB3135445 appears to just be an update client fix and likely is good.

 

[Swizz]

I appreciate the insight you guys.

Cheers.

 

[Seffrid]

Do we have a definitive list of which MS updates that should be avoided like the plague please?
Yeah, I know, .... all of them maybe, but just thought I'd ask.

The general answer is to leave all updates uninstalled for a few days and keep an eye on sites like this one, Ask Woody, and Windows Secrets. Only if no problems are being reported should you then consider installing the ones rated Important (as long as they're checked for installation, hold fire if they're offered unchecked) although Optional ones should generally be avoided altogether unless you have good reason to install any particular ones.

Susan Bradley at Windows Secrets always recommends holding back on updates relating to kernel-mode drivers for a couple of weeks pending her further recommendations, and that includes KB3134214 this week.

 

[ThrashZone]

A lot of Known issues with this one,
https://support.microsoft.com/en-us/kb/3126593

Known issues in this security update

Known issue # 1

After you install this security update, the behavior of searching for DLLs to load in certain scenarios (specifically, when loading implicit dependencies of COM server DLLs) will be changed from the previous behavior in the following way: Unless a prefix of the current directory’s full path is in the Safe Load List, the current directory will be skipped during the search (notice that previously, the current directory was used to search for the DLL). This new behavior may affect some legacy application behavior, and when the DLL loader notices this possible change in behavior, a warning or error message that resembles one of the following may be displayed in the Application log that is available in Event Viewer:

The following warning message indicates the dependency file was not loaded from the current working directory (CWD) because of it not being trusted, but was found in another location: Loading dependency %2 from the current directory was not allowed when attempted by %1. Another DLL was found: %3.


The following error message indicates the DLL was not loaded from the current working directory (CWD) because of it not being trusted, and was not found at all. Loading dependency %2 from the current directory was not allowed when attempted by %1. No other DLL was found and the dependency resolution failed.


In both cases, %1 is the full path to the application process’s executable (.exe) file, and %2 is the full path if the DLL is found in the CWD.

If the application requires the old dependency loading behavior for its correct operation for a specific directory, you can achieve this scenario by adding this directory or its trusted ancestor to the Safe Load List. To do this, follow these steps:

1. Make sure that your trusted location, together with all its descendant tree, is protected properly from unauthorized modifications by NTFS permissions.
2. Add a string value to the following subkey in the registry in which the data is the full path to that trusted location: HKLM\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes

After you make these changes, as long as the CWD is under that location, the DLLs in that CWD will be trusted and loaded as before.
Known issue # 2

Customers using Corel VideoStudio X8 or Corel VideoStudio X9 on Windows 7 may experience a crash while launching or using that product. Customers should install the latest updates from Corel to prevent this issue, or contact Corel for more information and help.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

Not as bad except for Corel video studios 8-9 users
https://support.microsoft.com/en-us/kb/3126587

Known issue # 1

Customers using Corel VideoStudio X8 or Corel VideoStudio X9 on Windows 7 may experience a crash while launching or using that product. Customers should install the latest updates from Corel to prevent this issue, or contact Corel for more information and help.

 

[Indianatone]

Short version
Net framework 4.6.1 is a Recommended update not a Important update
If your update settings were like this it would not be listed in the Important section
View attachment 381550

Once again on my 4 main PC's this setting was changed to Download and install automatically.
I have upgrades turned off in Groups Policy and the registry settings set not to download or upgrade the OS. M$ seems to want to override these settings.

KB3123862 according to the Register is extremely suspicious so I have uninstalled that one.
So what ever your Windows Updates setting normally is perhaps you should check it daily as I do now. Microsoft do not deserve me as a customer so I won't be.

http://www.theregister.co.uk/2016/02/02/microsoft_ups_pressure_win_10_holdouts/

 

[ThrashZone]

Recommended is a far cry from important
I believe you may have gremlins :mad2:

 

[UsernameIssues]

Once again on my 4 main PC's this setting was changed to Download and install automatically.

Could AVAST have made that change. Is AVAST on all 4 computers?

 

[Layback Bear]

KB3123862 is a NO NO on my computers.

 

[lehnerus2000]

Once again on my 4 main PC's this setting was changed to Download and install automatically.

Could AVAST have made that change. Is AVAST on all 4 computers?

I have Avast (free) and I haven't noticed my Windows Update settings changing.

I have noticed that updates to Windows Update often change my Windows Update settings to "Automatic".

Note:
These days I have the Windows Update service "Disabled".
I only enable it when I'm attempting to update W7.

 

[GEWB]

Not as bad except for Corel video studios 8-9 users
https://support.microsoft.com/en-us/kb/3126587

Also VideoStudio X7.

Had to uninstall KB3126587 and KB3126593 to get VS working again.

Regards,
GEWB

 

[ThrashZone]

Okay yea I have CD6 installed on another machine and it doesn't have a cpu in it at the moment so I can't see if it's effected or not yet :/
I doubt Corel will update anything
All Corel wants to do is upgrade people to CD7 which crashes all by it's bloody self

 

[Indianatone]

No Avast free is only on 2 of the PC's. I guess I should check the 3 PC's used as DVR's as Windows 10 on them would be a total fail seeing as all they do is play media. There are no gremlins it is M$ who are altering the settings. The best 2 machines have 2 OS on them and I have seen the setting change over the course of a day by itself with no one else around except me. Even my Toshiba Laptop with a clean install of 7 on it has been changed to install updates automatically. Maybe I should switch them off at night? I leave most of them on doing scans and stuff overnight.

 

[UsernameIssues]

Once again on my 4 main PC's this setting was changed to Download and install automatically.

Could AVAST have made that change. Is AVAST on all 4 computers?

I have Avast (free) and I haven't noticed my Windows Update settings changing.

I have noticed that updates to Windows Update often change my Windows Update settings to "Automatic".

Note:
These days I have the Windows Update service "Disabled".
I only enable it when I'm attempting to update W7.

I've seen more than one thread where update settings changed and AVAST was involved. Here is one... but I just skimmed the first post. (avast internet security pro)