February 2018 Update Summary

====================
Update: 28th February 2018:
Please scroll down in this post to view more recent software updates available since the original posting date of the 13th of February 2018. Thank you.
====================

Earlier today Microsoft made available their expected monthly security updates to resolve 50 vulnerabilities more formally known as CVEs (defined). As always further details are provided within Microsoft’s Security Updates Guide.

At the time of writing there are no Known Issues for this months updates.

====================

In addition to these updates; Adobe released updates for the following products:

Adobe Experience Manager (resolves 2x priority 3 CVEs)

Adobe Acrobat and Reader (priority 2, 41 CVEs)

Flash Player v28.0.0.161 (priority 1, 2 CVEs) (released on the 6th of February):

As always; you can monitor the availability of security updates for most your software from the following websites (among others) or use Secunia PSI:
—————
US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):

https://www.us-cert.gov/

A further useful source of update related information is the Calendar of Updates. News/announcements of updates in the categories of General SoftwareSecurity Software and Utilities are available on their website. The news/announcements are very timely and (almost always) contain useful direct download links as well as the changes/improvements made by those updates (where possible).

If you like and use it, please also consider supporting that entirely volunteer run website by donating.

====================
For this month’s Microsoft updates, I will prioritize the order of installation below. A useful list of all CVEs for this month is present here:

====================

CVE-2018-0825: StructuredQuery Remote Code Execution Vulnerability

CVE-2018-0850 and CVE-2018-0852 : Microsoft Office Outlook (separately the Office Equation Editor was disabled by this months updates to attempt to prevent further exploitation).

Microsoft Edge and Internet Explorer (multiple versions of Edge and IE affected)

====================

Please install the remaining updates at your earliest convenience.

As usual; I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues.

Similar to last month (due to the availability of further mitigations for x86 (32 bit) version of Windows); please take extra care with your back up to ensure you can restore your systems should you wish to revert your systems prior to installing the Meltdown and Spectre patches should you wish to uninstall the Security only bundle of updates or the updates are causing your system to become unstable or to lower its performance.

Thank you.

=======================
Update: 26th February 2018
=======================
=======================
VMware Updates:
=======================
In addition to last month’s VMware updates; further security updates have been issued in February. The affected products/appliances are listed below.

Please review the above linked to security advisories and knowledge base article and apply the necessary updates and mitigation steps.

  • VMware vCloud Usage Meter (UM) 3.x
  • VMware vIdentity Manager (vIDM) 2.x and 3.x
  • VMware vCenter Server (vCSA) 5.5, 6.0 and 6.5
  • VMware vSphere Data Protection (VDP) 6.x
  • VMware vSphere Integrated Containers (VIC) 1.x
  • VMware vRealise Automation (vRA) 6.x and 7.x

=======================
Google Chrome:
=======================
This month Google made available 2 updates for Google Chrome; one in early February and the other in mid-February each resolving 1 security issue.

Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 stacked small horizontal lines, sometimes called a “hamburger” button) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the updates to take effect.
=======================

=======================
VideoLAN VLC:
=======================
On the 28th of February VideoLAN made available VLC version 3.0.1 for Linux, Windows, macOS, BSD, Android, iOS, UWP and Windows Phone. It’s release notes detail fixes for 2 security issues (use-after-free (defined) and stack buffer overflow (defined)) and a further potential security issue (out of bounds (defined) read). More than 30 other non-security issues were also resolved.

Please update to version 3.0.1 to benefit from these improvements.

In early February VideoLAN made available version 3.0 for Linux, Windows, macOS, BSD, Android, iOS, UWP and Windows Phone. While its release notes do not detail any vulnerabilities addressed it includes smashing stack protection (SSP)(defined) and high entropy ASLR (HEASLR, also previously discussed on this blog)(ASLR: defined) for 64 bit versions of VLC. If you use VLC, you may wish to update to this version to benefit from the improved performance and features it offers while also increasing security.

=======================
Skype:
=======================
Earlier this month it was reported (for example here and here) that Skype contained an important elevation of privilege (defined) security vulnerability allowing the use of DLL (defined) hijacking (defined) within its update installer.

This vulnerability required a significant volume of remediation and was not addressed within the existing 7.40 version of Skype. Microsoft subsequently issued version 8 in October to address this vulnerability. 8.16.04 is the most recent version of Skype at the time of writing.

The above referenced version is the desktop version of Skype rather than the Microsoft Store app version which will be offered for Windows 10 installations.

Windows 7 and Windows 8.1 will be offered the 8.16.04 desktop version. Updates are available from skype.com Please note; for existing 7.40 users; an automatic update prompt will not display alerting you to the presence of version 8.

If you Skype, please upgrade it to the most recent version to resolve this vulnerability.

=======================
Wireshark 2.4.5 and 2.2.13
=======================
v2.4.5: 9 CVEs (defined) resolved

v2.2.13: 8 CVEs resolved

As per standard process Linux distributions can obtain this update using the operating systems standard package manager (if the latest version is not installed automatically using the package manager you can instead compile the source code (v2.4.5) or v2.2.13). This forum thread and this forum thread may also be helpful to you with installing Wireshark on your Linux based system.

For Mac OS X and Windows, the update is available within the downloads section of the Wireshark website. In addition, a detailed FAQ for Wireshark is available here

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.