Patching in Review – Week 24 of 2019

If you did not have the opportunity to join us for the June Patch Tuesday webinar, make sure to watch our recording before proceeding with this month’s patches.

As always, here are the quick links to stay up to date on any developing known issues:

• Windows 10 / Server 2019 / Server 2016
• Windows 8.1 / Server 2012 R2
• Server 2012
• Windows 7 / Server 2008 R2
• Server 2008

Patch Tuesday Follow-up

Although we go over as many known issues as possible during our Patch Tuesday Webinar, new issues tend to arise over the week that are very important to your next patching cycle.

The highest-profile issue within patching forums is related to Bluetooth devices no longer working on any patched endpoint. Microsoft has detailed this issue within a KB article where devices would now reject connections with the error “BTHPORT_DEBUG_LINK_KEY_NOT_ALLOWED”. This error is due to Windows now blocking well-known encryption keys, preventing exploitation of CVE-2019-2102. To resolve this issue, all relevant Bluetooth devices will need to be updated to gain successful connection to patched Windows endpoints.

An additional high-impact issue within Microsoft documentation surrounds Hyper-V. During this Patch Tuesday, Microsoft remediated three CVEs (CVE-2019-0620, CVE-2019-0709, CVE-2019-0722), detailing virtual machine escape vulnerabilities where arbitrary code can be executed on the host. The most alarming side effects to these fixes are detailed in Microsoft’s KB article, where the host will enter “Bitlocker Recovery mode” with an error if Bitlocker is enabled on the host. While a helpful workaround is supplied through the article, please roll this out to a test group if you have a chance to be affected.

As always, make sure to stay up to date on the issues as they develop via the links at the beginning of this post.

Third-Party Updates

While Patch Tuesday has been in the spotlight, other vendors have also released potentially valuable non-security updates this week. See the list below and be sure to add these to your patching cycle.