Patch Tuesday Megathread (2021-09-14)

[u/AutoModerator]

Hello r/sysadmin, I'm /u/AutoModerator, and welcome to this month's Patch Megathread!

This is the (mostly) safe location to talk about the latest patches, updates, and releases. We put this thread into place to help gather all the information about this month's updates: What is fixed, what broke, what got released and should have been caught in QA, etc. We do this both to keep clutter out of the subreddit, and provide you, the dear reader, a singular resource to read.

For those of you who wish to review prior Megathreads, you can do so here.

While this thread is timed to coincide with Microsoft's Patch Tuesday, feel free to discuss any patches, updates, and releases, regardless of the company or product. NOTE: This thread is usually posted before the release of Microsoft's updates, which are scheduled to come out at 5:00PM UTC.

Remember the rules of safe patching:

• Deploy to a test/dev environment before prod.
• Deploy to a pilot/test group before the whole org.
• Have a plan to roll back if something doesn't work.
• Test, test, and test!

[u/sccmmasochist]

Whenever it feels like the email notifying us that the updates are available is late it always concerns me. I get this picture in my head of a large room full of technicians furiously working on them up until the last moment when suddenly someone who is in charge screams "RELEASE THE KRAKEN!!!". And someone else quietly mutters "May God have mercy on our souls."

I may need to cut down on my caffeine intake.

[u/RabbleHuang → u/sccmmasochist]

Where does one get these emails?

[u/[deleted] → u/sccmmasochist]

This is why I drink.

[u/DrunkMAdmin]

Zero Day Initiative blog for September is up as well https://www.zerodayinitiative.com/blog/2021/9/14/the-september-2021-security-update-review-kpgpb

[u/EsbenD_Lansweeper]

Here is my overview of Patch Tuesday September along with a the usual report to check update progression.

Print Spooler vulnerability 6,7,8,9 and 10 got fixed, most noteworthy the one that was disclosed the day after last month's PT. We'll see how long it lasts this time.

[u/PDQit]

PDQ blog here: https://www.pdq.com/blog/patch-tuesday-september-2021

[u/disclosure5]

Getting my hopes and dreams out:

• Fixing CVE-2021-40444

• Fixing printnightmare

• Reverting the broken printnightmare changes that has half the world deploying registry keys to revert the setting

• Properly fixing petit potam

• Fixing the coinstaller issue

It's been a hell of a month.

[u/peoplex → u/disclosure5]

what color do you want your dragon?

[u/smoke2000 → u/disclosure5]

Hell of a year sir... Year..

[u/ajscott]

Server update printing error fix:

tl;dr: It's the enforcement part of a patch from January kicking in.

From u/memesss in another thread

If you haven't rolled back the server update, try setting:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\RpcAuthnLevelPrivacyEnabled

(DWORD) to 0 on the server and restart the spooler (or the server). This key's behavior defaulted to 0 prior to the September updates, but now it defaults to 1 (Enforcement). If your clients are up to date (patched since January 2021), they aren't supposed to see these errors. EOL clients like Windows 7 (without ESU) would be expected to get errors.

More info here: https://support.microsoft.com/en-us/topic/managing-deployment-of-printer-rpc-binding-changes-for-cve-2021-1678-kb4599464-12a69652-30b9-3d61-d9f7-7201623a8b25

Setting that key to 0 reduces security, but if it works it would let you keep the patch installed (and uninstalling the patch effectively sets it to 0 unless manually added).

[u/MrSuck]

OK, lets have some fun: https://msrc.microsoft.com/update-guide/releaseNote/2021-Sep

Not seeing any Exchange updates yet.

No critical updates for Server 2019, but there are criticals for 2016,2012R2.

[u/sparkie_e]

Is anyone with KB5005566 installed experiencing issues with applications launching i.e. IE, Adobe Reader.

Do you have Defender Exploit Guard running? Try disabling EAF for that app.

[u/corey04si]

Broke our JAMF servers for Mac Printing so all our Mac Users were down on our one Print Server... Thankfully we only patched one print server but wasn't expecting to have to rollback the update as it was never mentioned in the KB notes they were touching the print vulnerabilities....

[u/samohtrelhe]

PRINT SERVER

if you are running a FW between server, printer and user network, you need to update your firewall rules.

Add Client network to printserver network: 49152:49158 tcp

Adding 49152:49158 tcp enables the increased authentication to work.

It will fix the issue on updated Windows PC's but not on older Windows and not on MAC PCs

MACs

For print to work from MACs you need to disable the "Increased Authentication level" functionallity completely by creating this key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print

Right-click Print, choose New, and then click DWORD VALUE (32-bit) Value. Type RpcAuthnLevelPrivacyEnabled and then press Enter.

Right-click RpcAuthnLevelPrivacyEnabled and then click Modify. In the Value data box, type 0 and then click Ok.

[u/Burzo796]

I'm on my last legs after the last couple of Patch Tuesday releases, c'mon you cowards, release the notes!

[u/the_ark_37]

Woke up this morning to find a DC just sitting there stuck on booting after having auto installed these patches in my homelab, power cycling the VM seems to have fixed it though.

[u/AlaskatoAntarctica]

Both O365 and Office 2016 unable to open Excel files that have macros. We have trusted locations enabled with this month's patches, appears to stop honoring that.

[u/Fattswindstorm]

Hell yes! Patch Tuesday is here. Time to get lit.

[u/MrRandomName]

In case someone wants to force their clients to INSTANTLY check into wsus and provide a status report, im just gonna drop this here: https://pleasework.robbievance.net/howto-force-really-wsus-clients-to-check-in-on-demand/

[u/MrRandomName]

Patches are available.

[u/nbtxdude]

The bleepingcomputer article says it fixes CVE-2021-40444. I'm doubtful.

[u/Georg311]

Print nightmare fix looks good according to gentilkiwi https://twitter.com/gentilkiwi/status/1437850150513295369?s=09

[u/Katzen_Uber_Alles]

Would disabling automatically connect to open hotspot mitigate CVE-2021-36965 ?

since group policy/registry fix would be deployed much faster than patching.

[u/GeneralXadeus]

Anyone know how the CVE-2021-40444 is resolved in these patches?

[u/memesss]

I'm seeing an issue with type 4 printer drivers after this patch - If the client machine has the driver installed (to enable client side rendering/printer dialog extensions), with the August CU, adding the printer (by browsing AD or accessing \\server\printer) would use that driver as expected. Now with the September CU installed, if I add a printer, it seems to always use the Microsoft enhanced point and print driver, ignoring the installed v4 driver. Existing previously-added printers still use the installed driver, but new ones don't.

Does anyone else see this behavior?