Patch Tuesday (also known as Update Tuesday) is a term that’s used to describe Microsoft releasing patches for its software. It’s the second, and, from time to time, fourth Tuesday in the USA, and updates are usually published without a hitch. So it was quite surprising when Microsoft announced an indefinite postponement of February Patch Tuesday in its blog post. However, they have since updated it and said that all of the improvements and fixes that were supposed to be rolled out in February, will instead be released on March 14. Quoting Microsoft, “We will deliver updates as part of the planned March Update Tuesday, March 14, 2017.” So there’s no ambiguity anymore – the date has now been set.
But the questions regarding the delay still remain. Microsoft hasn’t provided any details, except for saying that it has “discovered a last minute issue that could impact some customers”, and it “was not resolved in time for planned updates.” So the only thing left to do for now is to play guessing game – and that’s exactly what the Internet has been doing.
There were many opinions expressed, but a lot of people think that Microsoft are updating their patch delivery system and simply weren’t able to finish with this in time for a February Tuesday Patch. That seems like the most logical reason, considering the recent announcement – which also came in February – about future security updates being released in a searchable database, and not in security bulletins as it has been done before. The list of things that were supposed to be done during the shortest month of the year doesn’t end there – there were plans for a separate release of Windows patches and security updates for Internet Explorer.
Unfortunately for Microsoft, this delay means that the company will still remain vulnerable to a zero-day in the SMBv3 protocol, which is bad news for users of Windows 8.1, 10, Server 2012, and Server 2016 will still be unable to handle traffic coming from a malicious server, which can lead to a Blue Screen of Death in mrxsmb20.sys. The fixing for a zero-day was also delayed, and it’s certainly a sticky situation for Microsoft.
But company’s public image is one thing – what about the users? CERT advises to block outbound SMB connections from the local network to the WAN, but points out that it’s not a solution to the problem – only a workaround. So the situation continues to remain questionable, to say the least.