{"id":8464,"date":"2017-07-26T10:30:11","date_gmt":"2017-07-26T18:30:11","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/07\/26\/news-2238\/"},"modified":"2017-07-26T10:30:11","modified_gmt":"2017-07-26T18:30:11","slug":"news-2238","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/07\/26\/news-2238\/","title":{"rendered":"Tiptoe through the bugs and get Windows and Office updated"},"content":{"rendered":"

<\/p>\n

Credit to Author: Woody Leonhard| Date: Wed, 26 Jul 2017 09:55:00 -0700<\/strong><\/p>\n

The fourth Tuesday of the month has come and gone, and it now looks reasonably safe to patch Windows and Office. I was expecting two big releases yesterday \u2014 one to fix numerous bugs in Win10 Creators Update, version 1703; the other to plug the bugs introduced by June\u2019s Office security patches<\/a> \u2014 but neither trove appeared. Given Microsoft\u2019s past patterns, it\u2019s unlikely that we\u2019ll see any more serious patches until next month\u2019s Patch Tuesday, on Aug. 8.<\/p>\n

There\u2019s also a bit of additional impetus right now. On July 17, security researcher Haifei published a proof of concept<\/a> for running malware scripts directly in Office apps. I haven\u2019t seen any exploits in the wild as yet, but it would be a good idea to install KB 3213640<\/a> (Office 2007), KB 3213624<\/a> (Office 2010), KB 3213555<\/a> (Office 2013) and\/or KB 3213545<\/a> (Office 2016) in the short term. (Thx to @LeaningTowardsLinux.) Note that none of these patches, as best as I can tell, correct the Office bugs introduced in June.<\/p>\n

July was a particularly problematic month for Windows and Office patches. At this moment, I see the following outstanding problems \u2014 none of which are overwhelming, but all of which may prove to be a pain to you, depending on your configuration and expectations:<\/p>\n

On the brighter side, the Surface Pro 4\/Surface Book firmware\/driver update difficulties I talked about two days ago<\/a>\u00a0didn’t turn into major problems. Microsoft has provided the documentation, at last, and it looks like the driver update is good to go.<\/p>\n

As always, I strongly recommend that you avoid installing the Preview Rollups on offer, such as KB 4025335<\/a>. That\u2019s easy \u2014 you have to check the right box to install the Preview, and you shouldn\u2019t be checking any boxes!<\/p>\n

Here are my recommendations:<\/p>\n

Windows 7 and 8.1<\/strong><\/p>\n

If you\u2019re very concerned about Microsoft\u2019s snooping on you, and only want to install security patches, realize that the path\u2019s getting more difficult. The old \u201cGroup B\u201d \u2014 security patches only \u2014 isn\u2019t dead, but it\u2019s no longer within the grasp of typical Windows customers. If you insist on installing security patches only, follow the instructions in @PKCano\u2019s AKB 2000003<\/a>.<\/p>\n

Microsoft is still blocking updates to Win 7 and 8.1 on recent computers. If you are running Windows 7 or 8.1 on a PC that\u2019s a year old, or newer, follow the instructions in AKB 2000004<\/a> or @MrBrian\u2019s summary of @radosuaf\u2019s method<\/a> to make sure you can use Windows Update to get updates applied.<\/p>\n

If you want to minimize Microsoft\u2019s snooping but still install all of the offered patches, turn off the Customer Experience Improvement Program (Step 1 of AKB 2000007: Turning off the worst Windows 7 and 8.1 snooping<\/a>) before you install any patches. (Thx @MrBrian).<\/p>\n

For most Windows 7 and 8.1 users, I recommend following AKB 2000004: How to apply the Win7 and 8.1 Monthly Rollups<\/a>. Watch out for driver updates \u2014 you\u2019re far better off getting them from the manufacturer\u2019s website.<\/p>\n

After you\u2019ve installed the latest Monthly Rollup, if you\u2019re intent on minimizing Microsoft\u2019s snooping, run through the steps in AKB 2000007: Turning off the worst Win7 and 8.1 snooping<\/a>. Realize that we don\u2019t know<\/strong> what information Microsoft collects on Win7 and 8.1 machines.<\/p>\n

Windows 10<\/strong><\/p>\n

It\u2019s still too early to jump to Win10 Creators Update, version 1703. Wait for it to be designated \u201cCurrent Branch for Business\u201d or, using the new bafflegab, \u201cSemi-annual Channel (Broad)\u201d ready. You can block the upgrade with a few simple steps, detailed in this Computerworld<\/em> post<\/a>. If you\u2019re presented with an option to review your privacy settings (screenshot), click “Remind me later” and forget about it.<\/p>\n

To get Win10 patched, run the steps in AKB 2000005: How to update Windows 10 \u2014 safely<\/a>. You may want to use wushowhide to hide any driver updates. All of the other updates should be OK, including Servicing stack updates, Office, MSRT or .Net updates (go ahead and use the Monthly Rollup if it\u2019s offered).<\/p>\n

As is always the case, DON\u2019T CHECK ANYTHING THAT\u2019S UNCHECKED<\/strong>.<\/p>\n

Time to get patched. Tell your friends, but make sure they understand what\u2019s happening. And for heaven\u2019s sake, as soon as you\u2019re patched, turn off automatic updating! If you can follow these instructions, you don’t have to serve as Microsoft patch cannon fodder.<\/p>\n

I just changed the MS-DEFCON level on the AskWoody Lounge<\/a>. Join us.<\/em><\/p>\n

http:\/\/www.computerworld.com\/category\/security\/index.rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/p>\n

Credit to Author: Woody Leonhard| Date: Wed, 26 Jul 2017 09:55:00 -0700<\/strong><\/p>\n

\n
\n

The fourth Tuesday of the month has come and gone, and it now looks reasonably safe to patch Windows and Office. I was expecting two big releases yesterday \u2014 one to fix numerous bugs in Win10 Creators Update, version 1703; the other to plug the bugs introduced by June\u2019s Office security patches<\/a> \u2014 but neither trove appeared. Given Microsoft\u2019s past patterns, it\u2019s unlikely that we\u2019ll see any more serious patches until next month\u2019s Patch Tuesday, on Aug. 8.<\/p>\n

There\u2019s also a bit of additional impetus right now. On July 17, security researcher Haifei published a proof of concept<\/a> for running malware scripts directly in Office apps. I haven\u2019t seen any exploits in the wild as yet, but it would be a good idea to install KB 3213640<\/a> (Office 2007), KB 3213624<\/a> (Office 2010), KB 3213555<\/a> (Office 2013) and\/or KB 3213545<\/a> (Office 2016) in the short term. (Thx to @LeaningTowardsLinux.) Note that none of these patches, as best as I can tell, correct the Office bugs introduced in June.<\/p>\n

To read this article in full or to leave a comment, please click here<\/a><\/p>\n<\/section>\n<\/article>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[11062,10643],"tags":[714,10525],"class_list":["post-8464","post","type-post","status-publish","format-standard","hentry","category-computerworld","category-independent","tag-security","tag-windows"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/8464","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=8464"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/8464\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=8464"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=8464"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=8464"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}