Coming Soon: GET:IT Endpoint Management 1-Day Conference on September 28th at 9:30 AM ET Coming Soon: GET:IT Endpoint Management 1-Day Conference on September 28th at 9:30 AM ET

Patch Tuesday -- July 2018

Virtual Desktop Infrastructure

This month’s Patch Tuesday was a relatively quiet one. Microsoft made a minor update to Spectre v4 patches, issued critical updates only for desktop editions of Windows, and patched three vulnerabilities that had already been publicly disclosed.



Sponsored Content

Say Goodbye to Traditional PC Lifecycle Management

Traditional IT tools, including Microsoft SCCM, Ghost Solution Suite, and KACE, often require considerable custom configurations by T3 technicians (an expensive and often elusive IT resource) to enable management of a hybrid onsite + remote workforce. In many cases, even with the best resources, organizations are finding that these on-premise tools simply cannot support remote endpoints consistently and reliably due to infrastructure limitations.

No Critical Patches for Windows Server

Microsoft issued 15 critical patches for Windows on Tuesday, July 10th. Unusually, they only apply to supported desktop editions of Windows, i.e. Windows 7 SP1 through to the Windows 10 April 2018 Update and not to any version of Windows Server. The patches affect Microsoft Edge, Internet Explorer, and the ChakraCore scripting engine. They could all lead to remote code execution, apart from one (CVE-2018-8324), which could cause information disclosure.

Publicly Disclosed Vulnerabilities

There are no zero-days in this month’s round of patches but there are three vulnerabilities that had already been publicly disclosed. CVE-2018-8313 is an elevation of privilege vulnerability and according to Microsoft, it is not being actively exploited. It affects Windows Server and desktop editions of Windows. Nevertheless, Microsoft says that is likely that attacks will occur.

CVE-2018-8314 is another elevation of privilege vulnerability that only applies to older versions of Windows. Finally, a Microsoft Edge spoofing vulnerability (CVE-2018-8278) affects Windows 10 Version 1803. An attacker could make it look like you are on a legitimate website. To exploit the vulnerability, hackers must either persuade the user to browse to a malicious website or be redirected to it.

Windows 10 1803 Promoted to Semi-Annual Channel

Windows 10 version 1803 build 17134.165, which is the build you get after installing this month’s Patch Tuesday cumulative update, is now being promoted by Microsoft for organizations updating on the semi-annual release channel (SAC). As reported by Brad Sams on Petri earlier this week, Microsoft is encouraging businesses to deploy Windows 10 version 1803. Microsoft’s recommendation doesn’t mean that you shouldn’t test version 1803 in your organization.

Microsoft Office

This month sees two Skype for Business vulnerabilities patched. One is remote code execution and the other a security feature bypass. Both are rated as important. Microsoft Office 2016 Click-to-Run (C2R) for 64-bit editions gets an important remote code execution patch and Microsoft Office 2010 Service Pack 2 (32-bit editions) gets a tampering fix that’s rated as low.

Adobe and Intel

Adobe patched Flash to plug CVE-2018-5007 and CVE-2018-5008, which are information disclosure and arbitrary code vulnerabilities respectively. Microsoft also made a minor update to the Spectre v4 patch that was first released last month.

BSOD After July Patches

Some users on Windows 10 are experiencing blue screens of death (BSODs) after applying this month’s patches, pointing to a tcpip.sys error. Windows 7 users might find that their network card stops working after applying the July update. Microsoft has offered a workaround for users experiencing this problem. Open Device Manager and select Scan for Hardware Changes from the Action menu.

That’s it for this month. Happy testing and patching.

Follow Russell on Twitter @smithrussell.


Related Topics:


Don't have a login but want to join the conversation? Sign up for a Petri Account

Comments (0)

Leave a Reply

IT consultant, Contributing Editor @PetriFeed, and trainer @Pluralsight. All about Microsoft, Office 365, Azure, and Windows Server.
Live Webinar: Active Directory Security: What Needs Immediate Priority!Live on Tuesday, October 12th at 1 PM ET

Attacks on Active Directory are at an all-time high. Companies that are not taking heed are being punished, both monetarily and with loss of production.

In this webinar, you will learn:

  • How to prioritize vulnerability management
  • What attackers are leveraging to breach organizations
  • Where Active Directory security needs immediate attention
  • Overall strategy to secure your environment and keep it secured

Sponsored by: