Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
FYI...
- https://technet.micr...curity/ms17-jan
Jan 10, 2017 - "This bulletin summary lists security bulletins released for January 2017...
Note: There are no security fixes or quality improvements for Windows 8.1 or Windows Server 2012 R2 for release on Update Tuesday for January 2017. As such, there is no Security -Only- Quality Update or Security -Monthly- Quality Rollup release for these platforms this month...
(Total of -4-)
Microsoft Security Bulletin MS17-001 - Important
Security Update for Microsoft Edge (3214288)
- https://technet.micr...curity/MS17-001
Important - Elevation of Privilege - Requires restart - Microsoft Windows, Microsoft Edge
Microsoft Security Bulletin MS17-002 - Critical
Security Update for Microsoft Office (3214291)
- https://technet.micr...curity/ms17-002
Critical - Remote Code Execution - May require restart - Microsoft Office, Microsoft Office Services and Web Apps
Microsoft Security Bulletin MS17-003 - Critical
Security Update for Adobe Flash Player (3214628)
- https://technet.micr...curity/ms17-003
Critical - Remote Code Execution - Requires restart - Microsoft Windows, Adobe Flash Player
Microsoft Security Bulletin MS17-004 - Important
Security Update for Local Security Authority Subsystem Service (3216771)
- https://technet.micr...curity/ms17-004
Important - Denial of Service - Requires restart - Microsoft Windows
___
MS17-001: http://www.securityt....com/id/1037573
MS17-002: http://www.securityt....com/id/1037568
- http://www.securityt....com/id/1037569
MS17-003: http://www.securityt....com/id/1037570
MS17-004: http://www.securityt....com/id/1037571
___
Security Updates Guide
- https://portal.msrc....curity-guidance
10-Jan-2017 - January 2017 Security Updates
Total items: 34
[Note: There are -some- updates listed for Win8.1 and WinSvr2012 R2 here.]
___
Security Advisories
- https://technet.micr...dvisories#APUMA
- https://technet.micr...ecurity/2755801
1/10/2017 - 2755801 - Update for Vulnerabilities in Adobe Flash Player in Internet Explorer and Microsoft Edge
- https://technet.micr...y/mt745127.aspx
- https://technet.micr...ty/3214296.aspx
Jan 10, 2017 - Vulnerabilities in Identity Model Extensions Token Signing Verification Could Allow Elevation of Privilege
___
January 2017 Office Update Release
- https://blogs.techne...update-release/
Jan 10, 2017 - "... This month, there are -2- security updates (1 bulletin) and -31- non-security updates.
Security bulletins: MS17-002: https://technet.micr...y/ms17-002.aspx
All of the security and non-security updates are listed in KB article 3214449:
- https://support.micr...n-us/kb/3214449
A new version of Office 2013 Click-To-Run is available: 15.0.4893.1002 ..."
___
ISC Analysis
- https://isc.sans.edu...wday=2017-01-10
2017-01-10
Qualys Analysis
- https://blog.qualys....ecurity-updates
Jan 10, 2017 - "... in the first Patch Tuesday of 2017 Microsoft fixed only 3 vulnerabilities which makes it one of the smallest patch month ever. Patches were released for Microsoft Office, the Edge browser and LSASS. It’s an unusually small patch update and will definitely make system administrators happy. For Windows server 2008 administrators, on top of the list is the LSASS or Local Security Authority Subsystem Service bulletin MS17-004 which is a denial-of-service condition which could allow unauthenticated attackers to trigger an automatic reboot. To exploit the vulnerability an unauthenticated attacker could send a specially crafted authentication request which would lead in the reboot condition. This vulnerability i.e. CVE-2017-0004 was publically disclosed before the availability of the patch and PoC exploit could become available soon. Windows 7 and Vista are also affected.
Top on the priority list for workstations is the critical Office bulletin MS17-002 which applies to Word 2016 and SharePoint 2016. An attacker could send a malicious file as an attachment and could take complete control of the system if the file is opened with the affected software.
Microsoft Edge bulletin MS17-001 affects Windows 10 and Windows Server 2016. It allows an attacker to access information from one domain and inject it into another domain resulting into getting elevated privileges. This vulnerability i.e. CVE-2017-0002 was publically disclosed before the availability of the patch.
It is also worth noting that starting next month Microsoft will scrap the existing system where users get a document each month in favor of a new ‘single destination for security vulnerability information’ called the Security Updates Guide. The new security portal is driven by an online database and instead of having to poke through an index of documents, users can sort, search, and filter the database to find details about a specific security bulletin and its associated updates..."
.
Edited by AplusWebMaster, 11 January 2017 - 04:52 AM.
