WannaCry Ransomware attack - please install MS17-010

Usage and Config Patch
2

Since Microsoft is now going to provide patches for previously unsupported OS’s (XP, 2003, 8) are there plans to make these installers available through BigFix?

reference: https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

4 Likes
3

I was just coming here to ask the same…

3 Likes
4

Same; here is a link to the update catalog entry for the relevant patches:
http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598

Since these are already available we’ve already taken steps to manually deploy where necessary, but fixlets from IBM would be highly appreciated.

Note that the Server 2008 (non-R2) KBs have been superseded by KB4018466:
http://www.catalog.update.microsoft.com/Search.aspx?q=KB4018466

5

For sure, I have implored the engineering team to produce the Fixlets as soon as possible.

3 Likes
6

Excellent, much appreciated!

1 Like
7

The Fixlets have just been released on Patches for Windows, version 2755.

4 Likes
8

Thanks for the quick turnaround, y’all, very much appreciated.

2 Likes
9

Note: Windows Patch Content Dev just released fixlets for XP and 2003 (out of support security update)

10

Please Thank them for their prompt efforts!

1 Like
11

The kill switch has been unintentionally found:

1 Like
12

Relax is still not the work I would use, I would still strongly recommend patching, even tho the kill switch was found for this campaign does not mean that similar attacks with modified content will not pop up quickly.

Thanks again to the team for getting this content out quickly.

2 Likes
13

Has anybody had issues with the WindowsXP fixlet? It seems to install the patch but it returns a fail 100% of the time relevance wise. Our R&D folks still have these for testing but until they are forced to rid of them we have to deal with them :slight_smile: KB4012598
I went to numerous machines and found that the patch was install.

1 Like
14

The reason the fixlet was failing is because it was checking for the wrong version of the srv.sys file… the version in the package is 5.1.2600.7208, but it looks like they inadvertently tested for the XP 64-bit or Server 2003 version (5.2.3790.6021). It looks like the fixlet has been updated with the correct version check.

1 Like
15

Thanks, that’s correct. Updated content is available in Patches for Windows, version 2756. We are sorry for the inconvenience caused.

1 Like
16

Thank you, we are rocking now!! :slight_smile:

17

More information on the attack itself at X-Force Exchange

18

Since MS has the patches in Rollups, what the best way to determine if just this single patch is installed?

19

Looks like it was separated out in one of the links above.

20

Alexa,

We are using this to look for the original KB’s for MS17-010 AND all the KB’s that superseded them.

not exists keys whose (name of it contains "KB4012216" or name of it contains "KB4013429" or name of it contains "KB4012598" or name of it contains "KB4012606" or name of it contains "KB4012214" or name of it contains "KB4012217" or name of it contains "KB4012213" or name of it contains "KB4012212" or name of it contains "KB4012215" or name of it contains "KB4015217" or name of it contains "KB4019472" or name of it contains "KB4015221" or name of it contains "KB4019474" or name of it contains "KB4015551" or name of it contains "KB4019216" or name of it contains "KB4015549" or name of it contains "KB4019264" or name of it contains "KB4018466" or name of it contains "KB4015550" or name of it contains "KB4019215") of keys ("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\";"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages";"HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Hotfix") of (x32 registries;x64 registries)

This should return any system that is not patched

3 Likes
21

It returns True on a Windows 10 Creator with all updates installed. I haven’t tried it on other systems.

2 Likes