KB4512506 Security Monthly Rollup update for Windows 7 - Aug. 13

[Brink]

August 13, 2019 - KB4512506 (Monthly Rollup)

Applies to: Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1


Improvements and fixes

This security update includes improvements and fixes that were a part of update KB4507437 (released July 16, 2019) and addresses the following issues:

• Security updates to Windows App Platform and Frameworks, Windows Wireless Networking, Windows Storage and Filesystems, Windows Virtualization, Windows Datacenter Networking, Microsoft Scripting Engine, the Microsoft JET Database Engine, Windows Input and Composition, Windows MSXML, Internet Explorer, and Windows Server.

For more information about the resolved security vulnerabilities, please refer to the Security Update Guide.

Known issues in this update



[ADDED 8/16] - KB4517297 Non-security Update for Windows 7 - August 16


How to get this update

Before installing this update

Microsoft strongly recommends you install the latest servicing stack update (SSU) for your operating system before installing the latest Rollup. SSUs improve the reliability of the update process to mitigate potential issues while installing the Rollup and applying Microsoft security fixes.

If you are using Windows Update, the latest SSU (KB4490628) will be offered to you automatically. To get the standalone package for the latest SSU, search for it in the Microsoft Update Catalog.

Prerequisite: The SHA-2 update (KB4474419) must be installed before installing this update. For more information on SHA-2 updates, see 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.

Install this update

Windows Update and Microsoft Update - None. This update will be downloaded and installed automatically from Windows Update.

Microsoft Update Catalog - To get the standalone package for this update, go to the Microsoft Update Catalog.

Windows Server Update Services (WSUS) - This update will automatically synchronize with WSUS if you configure Products and Classifications as follows:
Product: Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1
Classification: Security Updates

File information

For a list of the files that are provided in this update, download the file information for update 4512506.

Source: https://support.microsoft.com/en-us/help/4512506

See also:

• CVE-2019-1181 | Remote Desktop Services Remote Code Execution Vulnerability
• CVE-2019-1182 | Remote Desktop Services Remote Code Execution Vulnerability

Direct download links for KB4512506 MSU file from Microsoft Update Catalog:

:ar: Download KB4512506 MSU for Windows 7 32-bit (x86) - 182.7 MB

:ar: Download KB4512506 MSU for Windows 7 64-bit (x64) - 285.6 MB

 

[Brink]

If you’re running Windows 7 Service Pack 1 or Windows Server 2008 RS2 Service Pack 1 and having problems installing the August Windows security updates, SHA-2 support may be missing. Check our dashboard for more information:

Windows 10 message center - Windows Release Information | Microsoft Docs

Tweet

— Twitter API (@user) View on Twitter

 

[Brink]

UPDATE 8/14:

"Known issues" updated. See first post for more details.

 

[NoN]

There's inside the Tuesday Patch August 13, 2019 - KB4512506 (Monthly Rollup) a CVE ID: CVE-2019-9506 that needs the end-user having to set-up a manual modification in Regedit about to protect against "Key Negotiation of Bluetooth" (KNOB) attack.

Dword value "EnableMinimumEncryptionKeySize" (without quote) have to be set to 1 in the path:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Policies\Hardware\Bluetooth.


On my machine, I can see Bluetooth related .dll & .exe files have been updated to number 6.1.7601.24511 in System32.
My key stop at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Policies....

Can't find exact MS article id where the registry key has to be set or not to 1, only a source that mention that key without link. Any clue? Thanks

 

[Brink]

There's a Inside the Tuesday Patch August 13, 2019 - KB4512506 (Monthly Rollup) a CVE ID: CVE-2019-9506 that needs the end-user having to set-up a manual modification in Regedit about to protect against "Key Negotiation of Bluetooth" (KNOB) attack.

Dword value "EnableMinimumEncryptionKeySize" (without quote) have to be set to 1 in the path:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Policies\Hardware\Bluetooth.


On my machine, I can see Bluetooth related .dll & .exe files have been updated to number 6.1.7601.24511 in System32.
My key stop at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Policies....

Can't find exact MS article id where the registry key has to be set or not to 1, only a source that mention that key without link. Any clue? Thanks

This one?

https://support.microsoft.com/en-us...guidance-for-bluetooth-key-length-enforcement

 

[NoN]

Thanks!

Please note we are shipping this mitigation off by default because during testing of encryption key length enforcement, we found that some Bluetooth controllers may not respond or stop pairing. Some BT devices may not support the minimum encryption key length enforced by the Microsoft update. We understand that compatibility with your devices is important and as we cannot guarantee compatibility with key enforcement enabled. You can enable the mitigation based on your own risk assessment and compatibility needs. If you have access to sensitive data and use the device in an area that does not have physical security, we recommend enabling the mitigation for this security vulnerability.

That's all i wanted to know about...

 

[Brink]

 

[LevelBest]

I've tried installing this update this morning but it is failed with error code 80092004.

From the little I've read on the net, this has come about for those that installed"June’s Preview of Monthly QualityRollup for Windows 7 for x64-basedSystems (KB4503277)” which fixed an error caused by a previous update.

I can’t find any clear guidance from MS on what to do. Should I uninstall KB4503277 and try again to install KB4512506 OR just leave it until MS presumably fix this update. I don’t want to muck up my computer which to date has installed all updates just fine.

Due to work, I’ve got limited time (not to mention patience) to spend on this. Any ideas would be welcome.

 

[svnfrms2r]

This one?

https://support.microsoft.com/en-us...guidance-for-bluetooth-key-length-enforcement

The article does not say if the DWORD should be 32 or 64 bit.
Had to create the the whole thing from incl Policies... is that a sign that something is wrong, and if so, what?


Thank you!

 

[Brink]

The article does not say if the DWORD should be 32 or 64 bit.
Had to create the the whole thing from incl Policies... is that a sign that something is wrong, and if so, what?


Thank you!

Usually it will be for "DWORD (32-bit) Value".

 

[Brink]

Update: KB4517297 Non-security Update for Windows 7 - August 16

 

[LevelBest]

Update: KB4517297 Non-security Update for Windows 7 - August 16

BRink, is this in response to my post, number 8, that I could use some help with?

 

[Brink]

BRink, is this in response to my post, number 8, that I could use some help with?

No. It was just to let folks know about a new update that is related to this update.

 

[LevelBest]

No. It was just to let folks know about a new update that is related to this update.

Oh, so would you have any insight as to the problems I'm having as described in post number 8 ? I'd be grateful for any suggestions.

 

[Brink]

Oh, so would you have any insight as to the problems I'm having as described in post number 8 ? I'd be grateful for any suggestions.

Did you already try to manually download and install the update?

In addition:

Prerequisite: The SHA-2 update (KB4474419) must be installed before installing this update. For more information on SHA-2 updates, see 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.

 

[LevelBest]

Did you already try to manually download and install the update?

In addition:

Prerequisite: The SHA-2 update (KB4474419) must be installed before installing this update. For more information on SHA-2 updates, see 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.

Thanks, that pointed me in the right direction. There are two prerequisites. Full guidance here. This worked for me


https://www.ghacks.net/2019/08/15/if-you-get-windows-update-error-0x80092004-on-windows-7-or-server-2008-r2-do-this/

 

[Brink]

Great news.

 

[svnfrms2r]

Usually it will be for "DWORD (32-bit) Value".

Thank you

 

[Brink]

 

[patdu1]

Thanks, that pointed me in the right direction. There are two prerequisites. Full guidance here. This worked for me


https://www.ghacks.net/2019/08/15/if-you-get-windows-update-error-0x80092004-on-windows-7-or-server-2008-r2-do-this/

This helped me as well... BUT

After installation of KB4512506 my PC did not reboot !
Related info here: https://community.spiceworks.com/topic/2226822-patch-tuesday-august-2019-breaking-computers-auto-repair-loop?
and here: Patch Tuesday, August 2019 Edition — Krebs on Security
I am in the UEFI, GPT,NMVe configuration (seems that matters)...

Of course my Windows7 Install DVD does not include any NVMe drivers, so my "C: drive" was not visible to be repaired when booting from the DVD.
That's how I registered here to get the NVMe drivers and ended up using the updater from SIW2 (Update your Win 7 installation media.) to update my DVD.
This great tool saved me (and my system) as I was able to revert the faulty update as per the following comment:
Patch Tuesday, August 2019 Edition — Krebs on Security

Please note that the commands below, listed in the spiceworks link did not work for me.

dism /image:c:\ /remove-package /packagenameackage_for_KB4512486~31bf3856ad364e35~amd64~~6.1.1.9
dism /image:c:\ /remove-package /packagenameackage_for_RollupFix~31bf3856ad364e35~amd64~~7601.24511.1.9

I hope this can help someone, and must thank again SIW2 for his updater!