Update for Exchange and Microsoft Installer drives Third patch test

This is a relatively light Patch Tuesday update from Microsoft, despite many serious vulnerabilities in the Windows platform (CVE-2021-38631 and CVE-2021-41371), both of which involve handling of the Remote Desktop Protocol, have been revealed and are showing how urgent it is to apply Windows updates. And we also have another technically challenging update to Microsoft Exchange Server to manage.

Pay attention to Service Stack Updates (SSU) this month, as it may affect how your apps are installed (especially focusing on the uninstall process). Microsoft has said there won’t be a C patch cycle release next month, which means Tuesday’s December patch release will be light. You can find more information about the risks of deploying these Third Patch updates with this infographic.

Main test scenarios

No high-risk changes have been reported to the Windows platform this month. However, there is a reported functionality change and an extra feature:

• You will have to check your printer again. Try using Notepad first, then Adobe Reader (PDF) and include images (PNG, JPG, BMP). Checking is especially important if you have the V3 printer driver.
• If your line of business applications are using COM (or banning DCOM), you’ll need to check the whole thing. Changes in the COM STA Threading model can lead to situations that are difficult to troubleshoot.
• Using Microsoft Movie and TV apps, play MP4 videos and check for audio problems.
• You may not be using Internet explorer (IE), but applications may depend on IE components (IEFRAME.DLL). Evaluate your application catalog for this key dependency, then check for Office component integration issues and browse by tabbed.
• Also, see Microsoft Timeline, as small changes have been made to the way your data is managed.

The biggest issue (or technical task) this month is the need to verify that your apps install, repair, update, and uninstall correctly. Your test Windows Installer log (0 is success). I think this is a big deal because we usually focus on app installation; this time we have to look at how apps are uninstalled. After an app has been uninstalled, the target machine should be clean, with no error logs, and no broken apps. Doing this correctly will allow the next MSI Installer update to run smoothly.

Known Issues

Each month, Microsoft includes a list of known operating system and platform issues included in this update cycle. Here are some of the key issues related to the latest Microsoft builds, including:

• After installing June 21, 2021 (KB5003690), some devices may not be able to install new updates, such as the July 6, 2021 update (KB5004945) or later. You will receive an error message, “PSFX_E_MATCHING_BINARY_MISSING.” For more information and workarounds, see KB5005322.
• Some Windows 10 LTSC systems are experiencing problems after installation KB4493509. Devices that have some Asian language packs installed may get an error, “0x800f0982 – PSFX_E_MATCHING_COMPONENT_NOT_FOUND.” Microsoft is currently working on a fix.
• The Windows print client may encounter the following errors when connecting to a remote printer that is shared on the Windows print server: 0x000006e4 (RPC_S_CANNOT_SUPPORT), 0x0000007c (ERROR_INVALID_LEVEL), 0x00000709 (ERROR_INVALID_PRINTER_NAME). Microsoft is addressing this issue. We hope that there may be an OOB update to address these issues before the December release B (Patch Tuesday). The good news here is that most of these reported printer problems are related to corporate environments (for example, a printer server associated with a domain controller); Most home users won’t be affected by security concerns or printing issues.

After installing this month’s Microsoft update, connections to untrusted domain devices using Remote Desktop may fail to authenticate when using smart card authentication. You may get a “Your credentials are not working” prompt. This issue is resolved using the Known Issue Recovery (KIR) – it’s interesting. Microsoft now allows policy-driven execution paths of managed code. In the event of a crash, you can restore the executable path of the affected files, returning that piece of code to its “pre-patch” state. To do this successfully, you need to make sure that you have the correct policy files for your platform. You can find the relevant policy files for each version of Windows here:

One of the best ways to see if there are known issues affecting your target platform is to check the many configuration options to download patch data at Microsoft Security Update Guide website or Summary page for this month’s security update.

Major Revisions

There are no major revisions (or even document updates) this month.

Minimize and solve

As of November 12, Microsoft has not announced any mitigations or workarounds regarding this month’s update cycle.

Each month, we break down our update cycles into product families (as defined by Microsoft) with the following basic groups:

• Browser (Microsoft IE and Edge);
• Microsoft Windows (both desktop and server);
• Microsoft Office;
• Microsoft Exchange;
• Microsoft Development Platform (ASP.NET Core, .NET Core and Chakra Core);
• Adobe (retired ???, yet).

Browsers

Microsoft has released a single significant update for Microsoft Edge. At its core, this patch is a Chromium code update, but it affects the way Edge IE mode work. The potential business impact of this update is negligible, so add this relatively simple update to your regular release schedule.

Windows

The Microsoft Windows platform has received 28 updates, with 3 rated as important and the remaining patches rated as important. Of greatest concern are the two publicly reported Remote Desktop Protocols (RDP) problem (CVE-2021-38631 and CVE-2021-41371). Microsoft has worked on the RDP protocol extensively over the past year with important updates being released every Patch Tuesday. I’ve always been skeptical about RDP, even though Microsoft provides some guidance and tools to protect your remote computer. Show recent supply chain issuesand the lack of fully integrated RDP alternatives, I think early and regular patching is our best bet. Add these updates to your Windows “Patch Now” calendar.

Microsoft Office

Microsoft has released four updates, all of which are rated as important. Affecting Access, Word, and Excel, these vulnerabilities require both local access to the target system and user interaction. Unfortunately, an Excel-related problem (CVE-2021-42292) has been reported to be exploited (despite being registered by Microsoft as a proof of concept). Although these Office-related security issues are not “bugs,“The exploitation of a publicly reported remote code execution vulnerability poses a significant risk to enterprise customers. Add these updates to your “Patch Now” release schedule.

Microsoft Exchange Server

Microsoft has released three important updates (CVE-2021-1349, CVE-2021-42305, CVE-2021-42321) for Exchange Server this month. All three updates link back to a Knowledge Base (KB) article, KB5007049. These updates will require a server restart and there is a differential probability that this may cause an installation failure or crash the Exchange Server (“break” as when there is no remote login) . There are some known issues with this update related to manual installation and UAC problem. Thoroughly test this update before deploying to production.

Microsoft Development Platform

This month’s update is a bit more exciting than usual. We have two updates (both rated as important) to Visual Studio that may result in instances of privileged upgrades. And unusually, Microsoft added a Open source project vulnerability from August to this month’s November update. The issue is critically assessed in the OpenSSL cryptographic framework (CVE-2021-3711) is used by Microsoft Visual Studio and is therefore considered a significant risk to Visual Studio users. This is a great call from Microsoft and really demonstrates its commitment to these types of open source projects. Add these updates to your regular developer rollout schedule.

Adobe (really just Reader)

This month, Adobe released three lower-rated issues affecting their RoboHelp (APSB21-87), in copy (APSB21-110) and Creative Cloud desktop (APSB21-111) applications. Although there are no updates available for Adobe Reader, we strongly recommend that you test print your PDF due to changes in the Windows printing system. Additionally, you may need to check that auto-update is still active in Adobe Reader after this month’s update has been installed.