January 2018 Update Summary

====================
Update: 31st January 2018:
Please scroll down in this post to view more recent software updates available since the original posting date of the 16th of January 2018. Thank you.
====================

Last Tuesday Microsoft released their routine security updates to address 56 vulnerabilities more formally known as CVEs (defined). Further details are provided within Microsoft’s Security Updates Guide.

This month there are 11 knowledge base articles detailing potential issues (many of which are pending resolutions) you may experience upon installing these updates. They are listed below for your reference:

4056890

4056891

4056892

4056893

4056888

4056895

4056898

4056894

4056897

4056896

4056899

====================

Separately Adobe released Flash Player v28.0.0.137 to address a single priority 2 CVE.

As always; you can monitor the availability of security updates for most your software from the following websites (among others) or use Secunia PSI:
—————
US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):

https://www.us-cert.gov/

A further useful source of update related information is the Calendar of Updates. News/announcements of updates in the categories of General SoftwareSecurity Software and Utilities are available on their website. The news/announcements are very timely and (almost always) contain useful direct download links as well as the changes/improvements made by those updates (where possible).

If you like and use it, please also consider supporting that entirely volunteer run website by donating.

====================
For January’s Microsoft updates, I will prioritize the order of installation below. I will discuss this month’s out of band (outside of the regular schedule) patches for Meltdown and Spectre in a separate blog post; the relevant CVEs are still listed below. A useful list of all CVEs for this month is present here:

====================
CVE-2017-5753 – Bounds check bypass (known as Spectre Variant 1)

CVE-2017-5715 – Branch target injection (known as Spectre Variant 2)

CVE-2017-5754 – Rogue data cache load (known as Meltdown Variant 3)

CVE-2018-0802: Microsoft Office zero day (similar to Novembers Office equation editor vulnerability)

Microsoft Office (18 further CVEs)

Microsoft Edge and Internet Explorer (multiple versions of Edge and IE affected)

====================

Please install the remaining updates at your earliest convenience.

As usual; I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues.

For this month; please take extra care with your back up to ensure you can restore your systems should you wish to revert your systems prior to installing the Meltdown and Spectre patches should you wish to uninstall the Security only bundle of updates or the updates are causing your system to become unstable.

Thank you.

=======================
Wireshark 2.4.4 and 2.2.12
=======================
v2.4.4: 3 CVEs (defined) resolved

v2.2.12: 4 CVEs resolved

As per standard process Linux distributions can obtain this update using the operating systems standard package manager (if the latest version is not installed automatically using the package manager you can instead compile the source code (v2.4.4) or v2.2.12). This forum thread and this forum thread may also be helpful to you with installing Wireshark on your Linux based system.

For Mac OS X and Windows, the update is available within the downloads section of the Wireshark website. In addition, a detailed FAQ for Wireshark is available here.

====================
Update: 24th January:
====================
Oracle:
====================
Oracle have resolved 237 vulnerabilities with the security updates they have made available this month. Further details and installation steps are available here. Within the 237 vulnerabilities addressed, 21 vulnerabilities were addressed in the Java runtime. 18 of these 21 are remotely exploitable without an attacker needing to obtain a user’s username and password (their credentials).

If you use any of the Oracle products listed here, please install the appropriate security updates as soon as possible.

Particular priority should be given to Oracle WebLogic Server and PeopleSoft due to documented incidents of attackers using such installations for crypto currency mining with one such incident resulting in more than USD $226,000 being mined. Further details are available in the following blog post from security vendor Onapsis.
=======================

=======================
Further updates released in January:
=======================
VMware Updates:
=======================
In early January; VMware issued security updates to address the Meltdown and Spectre vulnerabilities within some of their products. Another advisory  was also released later in January. The affected products/appliances are listed below. For virtual machines used with VMware Fusion and VMware Workstation, the steps listed within this knowledge base article should also be followed.

Please review the above linked to security advisories and knowledge base article and apply the necessary updates and mitigation steps.

Affected products/appliances:

  • VMware vCenter Server (VC)
  • VMware vSphere ESXi (ESXi)
  • VMware Workstation Pro / Player (Workstation)
  • VMware Fusion Pro / Fusion (Fusion)

=======================
Mozilla Firefox:
=======================
In January Mozilla issued security updates for Firefox and Firefox ESR (Extended Support Release):

Firefox 57.0.4 (2 mitigations added)

Firefox 58: 3x critical, 13x high, 13x moderate, 2x low CVEs

Firefox 58.0.1: 1x critical CVE

Firefox ESR 52.6: 1 high CVE

Firefox ESR 52.6: 2x critical, 8x high, 1x moderate

Further details of the security issues resolved by these updates are available in the links above. Details of how to install updates for Firefox are here. If Firefox is your web browser of choice, if you have not already done so, please update it as soon as possible to resolve these security issues.

=======================
Google Chrome:
=======================
In late January an update for Google Chrome was made available which included 53 security fixes.

Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 stacked small horizontal lines, sometimes called a “hamburger” button) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the updates to take effect.

=======================
7-Zip
=======================
In late January a security researcher located 2 vulnerabilities within 7-Zip. He reported them to the developer Igor Pavlov who very quickly released an updated version; v18.00 Beta. This has since been updated to 18.01 Stable to fix further issues (NOT security related).

The alternative Windows file manager Directory Opus will include the updated 7-Zip DLL (defined) within their next release. Their current beta already contains these fixes.

While 7-Zip does not have many vulnerabilities discovered within it (which has both advantages and disadvantages), there appears to be an increasing emphasis on it since it is used by anti-malware software and other applications e.g. VMware Workstation. Thus when a security update is issued; all of this software should eventually include the fixes. This occurred last year with the release of 7-Zip 16.00 to resolve 2 other security vulnerabilities.

Separately, Malwarebytes updated their Anti-Malware product to version 3.4.4 to update the 7-Zip DLL (defined) within it. Further details are available in my March 2018 Update Summary blog post.

If you use 7-Zip, please ensure it is updated to resolve both this year’s vulnerabilities and last year’s vulnerabilities (if you hadn’t already installed version 16 or later). Please also update Malwarebytes Anti-Malware or Directory Opus if you use them.

=======================
Nvidia Geforce Drivers:
=======================
This driver update applies to Linux, FreeBSD, Solaris and Windows and mitigates the Meltdown security vulnerability (CVE-2017-5753). While Nvidia’s GPUs are not vulnerable to Meltdown or Spectre, the GPUs interaction with an affected CPU has the potential for exploitation.The steps to install the drivers are detailed here. I detailed where Nvidia list their security advisories in a previous blog post. More details about the Meltdown and Spectre vulnerabilities are available in this blog post.

=======================
Hitman Pro:
=======================
As recommended on my Tools and Resources page, Hitman Pro (now part of Sophos Security) has been updated to version 3.8.20 (Build 292). This update resolves 2 vulnerabilities relating to libraries (defined) the tool uses namely zlib and libpng. Any previous version of the tool should update automatically when opened to the most recent version.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s