Patch Impact Assessment October 2019

Vulnerability Assessment

0

PUBLICLY DISCLOSED

1

EXPLOITED

0

ZERO-DAY

This October Patch Tuesday is an important but troubled patch release from Microsoft. With a browser out-of-band critical update (CVE-2019-1367) that has been widely reported as causing a number of deployment issues. Our advice this month is to patch Windows and Browsers, schedule your Office and development tool patches, and celebrate a month of no threats to Adobe software!

Threatscape

Exploitability

CVE-2019-1333

CVE-2019-1060

CVE-2019-1367

CVE-2019-1307

CVE-2019-1308

CVE-2019-1239

CVE-2019-1335

CVE-2019-1327

CVE-2019-1372

Windows

PATCH NOW!

VULNERABILITIES

3
CRITICAL

34
IMPORTANT

1
MODERATE

0
LOW

Microsoft has released 38 patches to the Windows platform this month, with two rated as critical (CVE-2019-1060, CVE-2019-1333) and a critical servicing stack advisory (ADV990001). Again, we are seeing updates to familiar windows components: Microsoft JET Engine, RDP, HTTP, APPX, GDI and XML Core Services.

We suggest that most organizations WAIT for a few more days, find out where the trouble-spots are, and then tested extensively before a general deployment.

Browsers

PATCH NOW!

VULNERABILITIES

5
CRITICAL

2
IMPORTANT

1
MODERATE

2
LOW

Microsoft has released ten updates to both browsers this month, with five rated as critical by Microsoft affecting the Chakra, JavaScript and VBScript engine.

Our advice: test your core applications, test all your printers, and then stage a measure roll-out on a departmental basis.

Office

SCHEDULE

VULNERABILITIES

0
CRITICAL

6
IMPORTANT

0
MODERATE

0
LOW

This month’s update brings several updates to Microsoft SharePoint Server with six updates rated as important for Microsoft Office applications.

Make a backup of your server before this update. Add these updates (both desktop and server platforms) to your standard, scheduled update release schedule

Dev Tools

SCHEDULE

VULNERABILITIES

1
CRITICAL

3
IMPORTANT

0
MODERATE

0
LOW

Microsoft has released a critical update for its Azure App Service (please sanitize your inputs) and two important updates (CVE-2019-1313, CVE-2019-1376) to the SQL Server Management studio (SSMS).

All these changes will require extensive testing, and so add these patches to your standard development release schedule.

Adobe

MARGARITA TIME!

VULNERABILITIES

0
CRITICAL

0
IMPORTANT

0
MODERATE

0
LOW

No updates this month for Adobe. It’s Margarita time.

Related Posts

Opinion

Migrate from Windows 7 to Windows 10 Before It’s Too Late: Everything You Need to Know!

Out-dated operating systems such as the beloved Windows 7, may still be functional but leave your company vulnerable. It is inherently risky to continue running Windows 7 and much safer to migrate to Windows 10 before it is too late.

Read More
Patch Tuesday

A Troubled Update to Critical Browser Patches for October Patch Tuesday

This October Patch Tuesday is an important but troubled patch release from Microsoft with a critical, out-of-band browser update that has been widely reported as causing a number of deployment issues.

Read More
Patch Impact Assessment Summary

Patch Impact Assessment (Threatscape Report) September 2019

Here’s our 2019 Patch Impact assessment report reformatted with our new “Threatscape” report, showing a more complete assessment of the risk of not installing September’s Patch Tuesday updates in an easily-digestible, at-a-glance report.

Read More