MS14-066 updated by Microsoft

Usage and Config Patch
1

Yesterday, Microsoft released their updated version of MS14-066 (KB2992611). In their release notes they recommend …

Customers running Windows Server 2008 R2 or Windows Server 2012 who installed the 2992611 update prior to the November 18 reoffering should reapply the update. See Microsoft Knowledge Base Article 2992611 for more information.

But when I look in my Console this morning, the updated MS14-066 Fixlets don’t seem to indicate that the 2008R2x64 servers I already patched, need to have the patch re-installed. I’m on Site Version 2127 for “Patches for Windows (English)” so I should have the most current Fixlets.

Am I missing something?

2

Hi Tim,

The revision of MS14-066 does not modify the KB2992611 in the original release. A new patch, Windows6.1-KB3018238-x64.msu, was released to address the issue. (Download page: http://www.microsoft.com/en-us/download/details.aspx?id=44618)

The new Fixlet 1406631 should be relevant to your system. Kindly let us know if this is not the case.

3

My mistake, must have misread the documentation. I was expecting the original MS14-066 (KB2992611) to have been superseded by the updated patch from Microsoft.

Thank you for clearing that up.

4

Sorry to bring up an old thread but has anyone else had an issue where they have applied the fixlet for the new version of the patch successfully and the old version starts showing up as relevant?

5

As I understand it, all the new patch did was just add a few cipher suites to the original patch. They should be exactly the same otherwise. If you’re seeing it relevant, try running it against a test machine and see if it still ping pongs between the two fixlets.