Bork Tuesday, Any Problems Yet?

On win 7 :
Anyone already installed the new IE update from 23 March 2018 ?

See post by Nick in the Update Alerts forum.

Cumulative security update for Internet Explorer: March 13, 2018 kb4089187 is replaced by :
Cumulative security update for Internet Explorer: March 23, 2018 kb4096040

 

You need to install KB4096040 if IE will not start (after having installed KB4089187). As IE updates are cumulative, you could wait until next month's monthly updates as the Mar 23 update will be included. If you do not use IE, this update can wait.

 

Yes, thanks!
I should have quoted from KB4089187 this part:

I have to apologize for not having quoted it.

=====

Although I have no problems with starting IE after having installed KB4089187, I may install KB4096040 later this weekend.
Just being curious.

 

5211 was taken away and replaced with KB4088881 for me. https://www.sevenforums.com/news/41...w-monthly-rollup-windows-7-a.html#post3381963 https://support.microsoft.com/en-us...-for-windows-7-sp1-and-windows-server-2008-r2

 

Follow-up :
OK, I went ahead, downloaded KB4096040 from the MS Catalog and installed it on Win 7 64-bit.
So far no problem.

 

I had Windows7-64bit updates today.
GWX pest came in again, KB2952664. I skipped it and hid it again.
Then MSRT for March, Flash, and a February 13 Cumulative security job KB4074598 (edit: NOT KB4074596). Nothing for March. A bit curious, me thinks. I haven't been on Windows 7 since early February. Perhaps that explains it.

 

There is no GWX functionality contained in the current version of KB2952664. See:

If you don't need (and don't want) that, you can skip KB2952664, of course, but there's no GWX functionality in it.

KB4074596 was not for Windows 7, it was for Windows 10.
Perhaps you meant KB4074598, the February 13, 2018, Monthly Rollup for Windows 7?
The March 13, 2018, Monthly Rollup for Windows 7, KB4088875, was withdrawn, because of issues. If KB4088875 wasn't installed right away, it is no longer offered. The April 10, 2018, Monthly Rollup for Windows 7 will probably be the next Rollup offered.

 

Please allow me to post again about the Cumulative security update for Internet Explorer: March 13, 2018 kb4089187 and the Cumulative security update for Internet Explorer: March 23, 2018 kb4096040

The reason behind the replacing of kb4089187 with kb4096040 is that IE may not start, in particular in organisations/enterprises.
And that is caused by (in MS own words already quoted) an invalid SHA1 certificate.
Besides installing kb4096040 there was another solution given by MS: Whitelist the SHA1 certificate to allow Internet Explorer 11 to start.

But now comes the question:
About which SHA1 certificate is MS actually speaking here?
Maybe I'm not looking good enough, but as far as I can tell MS is not telling in kb4089187 about which SHA1 certificate they are actually speaking. Without giving that info, how are people (organisations/enterprises) supposed to whitelist the SHA1 certificate?

Is it the SHA1 certificate of the .msu installer itself?
IE11-Windows6.1-KB4089187-X86.msu or IE11-Windows6.1-KB4089187-X64.msu

Anyone any idea?

 

I have no idea what MS was referring to because they were not specific. If they had have identified the certificate it would have helped, so I understand your frustration. I chose to disregard it - I expect their enterprise clients got the memo. The rest of us did not.

I tested KB4096040 on a vm system and it broke open DNS. I got the balloon 'additional logon information may be required'. My WiFi hotspot was up and down like a yoyo. The profile would load and I got internet access, then as soon as I opened a browser it dropped access. It happened on 3 different systems using the same hotspot (2x W7/32 and 1x64). I had to hack my registry and flush the DNS to allow my WiFi to work properly. I use open source DNS (not my ISP default). Changing the DNS to the ISP default did not remedy the problem.

I uninstalled KB4096040 as I do not think it is ready for prime time. It is a fix to fix a fix, but it is breaking other stuff.

Here is the registry hack (MS fix for the problem- though not published by them) ...

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet
Double-click on EnableActiveProbing
Change value to 0.
Reboot

You can change it back after the WiFi is working properly. It is up to you.

 

Should you install preview rollups for Windows?
Microsoft releases previews of monthly rollup updates for the operating systems Windows 7, Windows 8.1, Windows Server 2008 R2 SP1 and Windows 2012 R2 on the third Tuesday of each month.
March 25, 2018
https://www.ghacks.net/2018/03/25/should-you-install-preview-rollups-for-windows/

 

Thanks emmjay for your extensive reply !!

You're so right: it is indeed frustrating!!

That dword is set here (well, at least after kb4096040) to 1.
I don't use WiFi.
As far as I can tell, kb4096040 didn't cause problems here on Win 7 64-bit, and neither did kb4089187.

But I think I am going to restore a backup image nevertheless.
Thanks again.

 

Thanks for correcting me. It was 4074598. I'll fix my post. And thanks for your explanation regarding no March update.
Re 2952664 - hmm, so do I need it? I have the consumer experience turned off since day 1. What do you suggest and why?

 

I think you don't need it.
Same for me, I have CEIP turned off since installation, and I don't need (or want) KB2952664 in any way. I skip it, just like you do.

 

Here we go again:
KB4100480 - Windows kernel update for CVE-2018-1038
Applies to: Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1
https://support.microsoft.com/en-us/help/4100480/windows-kernel-update-for-cve-2018-1038

Thanks to Ron at https://www.wilderssecurity.com/thr...ons-for-march-2018.401221/page-2#post-2747714

Quoting from the KB4100480 article:

So we have to carefully read that list at the KB4100480 article.
It is for those who meet three requirements:
1. running Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1
2. 64-bit
3. if their computers were updated in or after January 2018 by applying any of the following updates.

I see it mentioned at the MS Catalog.

Anyone already installed it?

Edit to add:
See also post by emmjay at https://www.wilderssecurity.com/thr...r-windows-7-and-8.387895/page-19#post-2747733

 

I installed KB4100480 on my two Windows 7 x64 systems, on which the January, February and March Monthly Rollups were installed.

Nothing out of the ordinary on one Windows 7 x64 system.

However, on the other Windows 7 x64 system, after installing KB4100480, the KB947821 System Update Readiness tool was offered as an important update in Windows Update. Er... what?
On that system, last year, May 2017, the System Update Readiness tool was used to fix a blank/empty Windows Features list (Turn Windows Features on or off).
Today, after installing KB4100480, I checked Windows Features list (Turn Windows Features on or off). Yep! It was blank, again. Uh-oh!
Both that and the fact that the System Update Readiness tool was offered in Windows Update said that something was wrong.

Fix:
First, I ran the System Update Readiness tool. This time, it did not fix the blank Windows Features list issue.
Next, steps 3-7 of the Raymond.CC article Fix for Blank or Empty Windows Features List in Vista and 7, of which for step 7, "set full control permission before you can delete the corrupted registry key", I used option 4, "Manually Edit Registry permissions", as described in the Raymond.CC article 5 Ways to Solve Error While Deleting Key Problem When Editing Restricted Registry. That fixed the blank Windows Features list.
Finally, I did as described in the Microsoft article Fix Windows Update errors by using the DISM or System Update Readiness tool under "How to fix errors that are found in the CheckSUR.log".


EDIT
Despite the fixes, the CheckSUR.log was still a mess. I didn't like it at all.
I restored a recent image.
After restoring the image, I ran KB4100480.
This time, everything is fine, there is no blank Windows Features list issue, and the System Update Readiness tool is not offered in Windows Update.
All is well, great!
However, the earlier issue was not great at all, it is terrible to see how messy Windows updates can be.
Anyhow - thumbs up for system imaging!

 

Microsoft Releases Emergency Windows Update KB4100480 to Fix Meltdown Patch Bug
Company confirms “important” vulnerability on Windows 7
March 30, 2018
http://news.softpedia.com/news/micr...100480-to-fix-meltdown-patch-bug-520475.shtml

 

Woody Leonhard:
https://www.computerworld.com/artic...kes-the-brunt-of-march-patching-problems.html

And discussion at AskWoody Lounge:
https://www.askwoody.com/2018/microsoft-patch-alert-suddenly-windows-7-patching-is-an-unholy-mess/

 

Martin Brinkmann at gHacks:
KB4100480 out-of-band security update for Windows 7 and Server 2008 R2
https://www.ghacks.net/2018/03/30/k...rity-update-for-windows-7-and-server-2008-r2/

 

OK, I have just installed KB4100480 (which I manually downloaded from the MS Catalog) on Win 7 64-bit.
Note that I usually use only the Security-only updates; those and the IE cumulatives I download manually from the MS Catalog. I use WU for .NET Framework and Office 2010 updates.
So far no problems, but I have only just installed KB4100480.

As always: first make a backup image before you install MS updates.

PS:
I noticed that MS has edited the KB4088878 article yesterday:
March 13, 2018—KB4088878 (Security-only update)
https://support.microsoft.com/en-us/help/4088878/windows-7-update-kb4088878
Quote from that article now:

 

"If you have any January through March update installed, make sure KB4100480 is installed.

Otherwise go into add/remove programs and roll back to December’s KB4054521 (security only) or KB4054518 (rollup) and then hang tight and keep our fingers crossed that April’s updates will resolve these issues.

And then Microsoft please please please, do something about these known issues and fix them, because it pains me greatly to publically type this." https://www.computerworld.com/artic...s-an-ip-stopper-and-little-documentation.html

 

Mad March Meltdown! Microsoft's patch for a patch for a patch may need another patch

https://www.theregister.co.uk/2018/04/03/microsoft_windows_meltdown_patch_saga/

 

It appears that WSUS is having problems with the sequencing of these updates. Windows Updates is supposed to be able to determine this, but it too can get a bit swirly with 'who's on first'. Most of the prerequisites were not included in the originally released updates for JAN and MAR. They were added at least a week after the updates were sent out. No wonder WSUS has gone swirly.

 

Hi Emmjay, the one update in W7 that has me confuse on what to do that applies to my W7 32 bits is KB4099950. This update is now a prerequisite for KB4088878 (the update I installed for March). Since KB4099950 came out after KB4088878, us who installed KB4088878 before KB4099950 was released, what are we supposed to do? Install it or stay away. My W7 has no issue with KB4088878 without installing KB4099950. Very confusing.

Bo

 

You are correct, it is supposed to be installed before KB4088878. If you do not use static IP addresses, you do not need to install it at all.

 

Emmjay, check this out. According to the link below, my IP is....Static . I looked it up while using my W10. But I believe is should be the same for the W7.
https://whatismyipaddress.com/



Bo