Vulnerability scan and Windows Update KB4025339

Question

Vulnerability scan and Windows Update KB4025339

Federico Coppola 1,181

Hi all,
In a company has been done a Vulnerability assessment using a dedicated software.
Vulnerability reports talks about a missing Windows Update on a VM with Windows 2016 Datacenter

The fix is install KB4025339 (more details here: https://www.tenable.com/plugins/nessus/101366)
I have seen that this WIndows Update is very old (year 2017) and I installed last windows update more or less a week ago.

After that I did not found this KB on Microsoft Catalog Update.

How can I solve it?
Thanks in advance

Federico

Accepted answer

7 additional answers

Your answer

Answer 1

Windows updates are now cumulative so the current update contains new fixes plus those of the previous cumulative updates.

To bring windows current all that's needed is to install the latest SSU
https://www.catalog.update.microsoft.com/Search.aspx?q=KB4576750

followed by the latest cumulative update.
https://www.catalog.update.microsoft.com/Search.aspx?q=KB4580346

There's no harm in skipping those in between.

Quality updates are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update, including any out-of-band security fixes and any servicing stack updates that might have been released previously.
https://learn.microsoft.com/en-us/windows/deployment/update/get-started-updates-channels-tools

How can I solve it?

May need to ask the vendor about the problematic report.

--please don't forget to Accept as answer if the reply is helpful--

Anonymous

2020-10-15T00:59:54.677+00:00

Hi,
Thanks for posting here!
As @Anonymous said ,Windows Updates are now cumulative so the current update contains new fixes plus those of the previous cumulative updates.
If there's anything you'd like to know, don't hesitate to ask.

Best Regards,

Answer 2

kearly37 1

Tenable has a note that says that a registry or group policy setting must be changed for eh fix to take effect.

Amit Kumar Singh 121 Reputation points

2022-02-11T08:07:07.887+00:00

Could you please share the registry setting for this.
kearly37 1 Reputation point

2022-02-11T16:25:42.637+00:00

I believe that this is the one that I needed - CVE-2017-8563. Tenable should have a snapshot of the scan output that gives details for the specific issue.
https://support.microsoft.com/en-us/topic/use-the-ldapenforcechannelbinding-registry-entry-to-make-ldap-authentication-over-ssl-tls-more-secure-e9ecfa27-5e57-8519-6ba3-d2c06b21812e
Anonymous

2022-06-01T08:29:18.687+00:00

Hi Frederico,

I have same issue. I wanted to learn whether this registry settings solution worked/or did u find another solution?

Answer 3

Anonymous

Glad to hear of success.

--please don't forget to Accept as answer if the reply is helpful--

Answer 4

Federico Coppola 1,181

Dear @Anonymous ,
I have upgraded to the lastest CU using our WSUS server with success.

I will try to execute again vulnerability scan.

Best regards
Federico

Answer 5

Anonymous

That's fine, follow up by installing the latest cumulative update.
https://www.catalog.update.microsoft.com/Search.aspx?q=KB4580346

--please don't forget to Accept as answer if the reply is helpful--

Share via

Vulnerability scan and Windows Update KB4025339

7 additional answers

Your answer