March 13, 2018 - KB4088878 (Security-only update) Windows 7

[Brink]

March 13, 2018 - KB4088878 (Security-only update)

Applies to: Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1

---

Improvements and fixes

This security update includes quality improvements. No new operating system features are being introduced in this update. Key changes include:

• Provides cumulative Spectre and Meltdown protections for 32-Bit (x86) and 64-Bit (x64) versions of Windows except the KB4078130 update that was offered to disable mitigation against Spectre Variant 2.
• Security updates to the Microsoft Graphics component, Windows Kernel, Windows Shell, Windows MSXML, Windows Installer, and Windows Hyper-V.

For more information about the resolved security vulnerabilities, see the Security Update Guide.

Prerequisites

Important Please apply KB4099950 before installing this update.

Notes

Important Please apply KB4100480 immediately after applying this update. KB4100480 resolves an elevation of privilege vulnerability in the Windows Kernel for the 64-Bit (x64) version of Windows. This vulnerability is documented in CVE-2018-1038.

Known issues in this update




How to get this update

This update is now available for installation through WSUS. To get the standalone package for this update, go to the Microsoft Update Catalog website.

File information

For a list of the files that are provided in this update, download the file information for update 4088878.

Source: https://support.microsoft.com/en-us/help/4088878


Direct download links for KB4088878 MSU file from Microsoft Update Catalog:

:ar: Download KB4088878 MSU for Windows 7 32-bit (x86) - 17.9 MB

:ar: Download KB4088878 MSU for Windows 7 64-bit (x64) - 29.7 MB

 

[lehnerus2000]

Thanks Brink.

 

[ranett]

Much appreciated.

 

[Paul Black]

Hello Brink,

These quotes are from the March cumulative update thread but I should have asked my question in this thread, sorry about that.

Just as a clarification please!

I don't install the Cumulative "Monthly rollups" so what should I do about the January 2018 and February 2018 Security-only-updates, should I install them BOTH AND the March 2018 Security-only-update, or JUST the March 2018 Security-only-update please?

You could try just the March update. If no issues, then no need to worry about the others.

Thinking about this on two levels:

(1) If the January 2018 and February 2018 Security-only-updates were NOT installed, would it now be SAFE to install them along with the March 2018 Security-only-update because the March 2018 Security-only-update includes the fix for the whole Spectre/Meltdown issue?

(2) On a clean install (obviously after KB3020369, KB3125574, KB3172605 & KB3179573 have been installed), would I be correct in saying that ALL the Security-only-updates from October 2016 to March 2018 can now be installed, again, because the March 2018 Security-only-update includes the fix for the whole Spectre/Meltdown issue?

The above is ONLY related to Security-only-updates.

Thanks in advance.

 

[Brink]

Paul,

Q1) It would be fine to install the Jan. and Feb. security-only updates first, then the Mar. security-only update afterwards.

Q2) With a clean install, it would probably be best and easier to install the cumulative updates instead of from 2016 forward.

 

[Paul Black]

Brilliant, thanks Brink,

...easier to install the cumulative updates...

I assume you mean to JUST install the March 2018 cumulative update after KB3020369, KB3125574, KB3172605 & KB3179573 have been installed?

 

[Brink]

There will be a lot more to install than that from 2016. I would recommend to install all Windows Updates selected by default, restart when prompted, and repeat until all updates have been installed.

Afterwards, create a system image with say Macrium Reflect. This way you could use this image backup as a starting point to restore next time instead of a full clean install.

 

[Paul Black]

Thanks for the reply Brink, it is appreciated.

There will be a lot more to install than that from 2016.

I realise that, but it is just a quick initial way of getting over the many checks for updates needed, the time needed to download the many updates, the time it takes to install the many updates and the many many restarts needed.
I have KB3020369, KB3125574, KB3172605 & KB3179573 and all the security-only updates (.msu) already downloaded and ready to go (I will probably integrate the updates offline using DISM and create a new ISO using oscdimg anyway).
This will substantially reduce the time needed for completion.
Then after the clean install when I check for updates the list won't be 200+ updates and many hours of work ahead and I can decide what I want to install.

Afterwards, create a system image with say Macrium Reflect. This way you could use this image backup as a starting point to restore next time instead of a full clean install.

Most definately, I use Aomei which is brilliant.

Out of interest Brink, do you know if Microsoft are going to release anything like a Final Service Pack for those of us that are going to stick with Windows 7. This would undoubtably make clean installs a lot easier and far less tedious?

Thanks again.

 

[BlueGuy]

Out of interest Brink, do you know if Microsoft are going to release anything like a Final Service Pack for those of us that are going to stick with Windows 7. This would undoubtably make clean installs a lot easier and far less tedious?

Thanks again.

THAT would be great, especially if it was available on optical {DVD}, at least as a mail-order option.

 

[Brds7t7]

Out of interest Brink, do you know if Microsoft are going to release anything like a Final Service Pack for those of us that are going to stick with Windows 7. This would undoubtably make clean installs a lot easier and far less tedious?

Thanks again.

Never going to happen unfortunately. MS isn't interested in sending out Service Packs for what they consider older software, they'd prefer everyone upgrade to Windows 10.
The closest we got to an SP2 was the Convenience Update in 2016, but I didn't install it as it seemed to cause a few issues. Plus, it's outdated now anyway, and included a few updates which some consider unnecessary.

https://support.microsoft.com/en-gb/help/3125574/convenience-rollup-update-for-windows-7-sp1-and-windows-server-2008-r2

 

[BlueGuy]

No matter how frustrated you get..... DO NOT THROW IT OUT OF THE WINDOW!!! :roflmao:

I didn't, just replaced the CPU.

 

[Brds7t7]

I didn't, just replaced the CPU.

I keep forgetting I even have that at the bottom of my posts as I've had my signature display settings set to disabled for about 4 years now!

Really must change that!

 

[lehnerus2000]

Uh Oh

Luckily I haven't even applied February's patches yet.

Shortly after the patch appeared, we started hearing from admins that both the pushed Monthly Rollup and the download-and-manually-install Security-only patch, KB 4088878, were causing problems with IP addresses on servers’ virtual Network Interface Cards (vNICs). After applying the update, the server — and sometimes individual machines — simply dropped off the network because their manual IP addresses had been altered.

https://www.computerworld.com/artic...5-hopefully-as-a-precursor-to-yanking-it.html
​

 

[BlueGuy]

Holy crap! Glad I held off until the hardware repairs on this machine were finished, now that article explains why the rollup disappeared from my WU dialogue and I was just left with the Malicious Software tool. As well as the CPU, as mentioned in the above posts, had to clear the CMOS before it would boot again. I knew there was nothing wrong with my Win7 OS, when it wouldn't boot from the Linux CD and USB dongle when the DVD was/still is, set as first boot device. Still have to use the contact cleaner I bought on the DIMMS but they seem OK for now.

Edit: Still have the February rollup in WU history, must have missed the memo on having to manually retrieve the Security-only ones, so I must be out of those since January. Seems better to trust my A-V efforts, MalwareBytes and keeping a tight reign on the firewall, indeed after the CPU replacement, had to reset permissions on some of my utilities, can't figure out why but better safe than sorry.

 

[ThrashZone]

Luckily I haven't even applied February's patches yet.

https://www.computerworld.com/artic...5-hopefully-as-a-precursor-to-yanking-it.html
​

Hi,
Yeah I haven't updated since December 2017
Still have a install back to June 2017 too lol before the so called Quality rollup which I don't know I keep using not sure why :/

 

[Lady Fitzgerald]

After the disastrous results from January's Security only updates that reduced my computer to an almost unusable mess (I had to restore the image I made before the update to get my computer back) and the reports I'm reading about the March one, I've given up on MS updates for now (maybe forever). MS was messed up enough under Ballsmore (sic) but it has really gone south under Nutella (sic).

 

[Brds7t7]

After the disastrous results from January's Security only updates that reduced my computer to an almost unusable mess (I had to restore the image I made before the update to get my computer back) and the reports I'm reading about the March one, I've given up on MS updates for now (maybe forever). MS was messed up enough under Ballsmore (sic) but it has really gone south under Nutella (sic).

Windows updates definitely seem to be getting more hit & miss as the months go by.

This is exactly the reason (well one of them) why I wouldn't jump to Windows 10. No way do I want forced updates with MS track record lately. Yes, images do solve the issue, but we shouldn't have to be going through all that for a botched update in the first place!

 

[ThrashZone]

Hi,
Yeah 10 I mostly only benchmark with it so I spend more time restoring system images than using 10
7 is still a daily driver security risks or not
Have good antivirus and turn off remote desktop features and good judgement will have to work because this is getting beyond silly as hell :/

 

[BlueGuy]

I still dream of an alternate universe where the Tramiel brothers actually listened to their users and came out with an open architecture machine, like a TT Plus, with a Motorola 68060, no restrictions on amounts of RAM [unlike Windows] the OS protected inside a set of ROM chips, high rez colour because the killer apps were already there, apps like Keyboard Controlled Sequencer, etc. All it needed was some kind of universal font converter. Alas though, the company folded in '98 before they had the chance to try Motorola's 64 bit power PC chip. Atari Computers, a separate entity from Atari Games, was popular in Canada and Europe but couldn't crack the US market where Apple was the juggernaut. It was a real tight community too.

This not listening to users is not endemic to Microslop alone. Just sayin', while waxing nostalgic .

 

[lehnerus2000]

This not listening to users is not endemic to Microslop alone. Just sayin', while waxing nostalgic .

If a car had defects the manufacturer would have to fix/replace it.

When are AMD & Intel going to replace our defective CPUs?

Why hasn't MS been forced to:

• Recall W10 due to the ridiculous number of defects in it?
• Pay compensation to everyone whose time hasn't been wasted?

Until IT corporations are treated the same, as corporations that make physical products are treated, nothing will change.