Well, as I understand it, the emergency patch MS-14-68 is to fix an issue
that will allow an attacker to get elevated privileges.
This is the text from the bulletin:
Vulnerability in Kerberos Could Allow Elevation of Privilege (3011780)
This security update resolves a privately reported
MS14-068 is not MS14-066
Two different vulnerabilities.
MS14-068 is a Kerb - we can own your DC.
MS14-066 is a vuln over Schannel.
The revision for the MS14-066 is needed as they added additional ciphers
to the patch that fixes the vuln which in term
a. caused issues with websites and
P.S.
Microsoft should not be ADDING new cipher deployments in a security
patch. That should have been included as an optional update. Don't be
thowing too much into a patch. This isn't the time to be adding new
stuff when you clearly are not testing as well as you used to.
Sorry this isn't
Agreed.
So your take is like mine that KB3018238 is a bug fix, and is not required to
patch the vulnerability?
gt
Date: Sun, 23 Nov 2014 08:11:44 -0800
From: sbrad...@pacbell.net
To: ntsysadm@lists.myitforum.com
Subject: Re: [NTSysADM] MS14-066 Round Two
P.S.
Microsoft should
Subject: Re: [NTSysADM] MS14-066 Round Two
P.S.
Microsoft should not be ADDING new cipher deployments in a security
patch. That should have been included as an optional update. Don't be
thowing too much into a patch. This isn't the time to be adding new
stuff when you clearly
, and is not
required to patch the vulnerability?
gt
Date: Sun, 23 Nov 2014 08:11:44 -0800
From: sbrad...@pacbell.net mailto:sbrad...@pacbell.net
To: ntsysadm@lists.myitforum.com
mailto:ntsysadm@lists.myitforum.com
Subject: Re: [NTSysADM] MS14-066 Round Two
P.S
, 23 Nov 2014 13:19:51 -0800
From: sbrad...@pacbell.net
To: ntsysadm@lists.myitforum.com
Subject: Re: [NTSysADM] MS14-066 Round Two
The original patch patches the schannel vulnerability.
The second patch fixes the bug in the cipher additions.
Honestly, both will keep you patched up
7 matches
Mail list logo
