What Is Patch Tuesday and When Is It?

[Pelican Press 0]

What Is Patch Tuesday and When Is It?

What is Patch Tuesday?

Patch Tuesday is the commonly known name of

This is the hidden content, please

• Sign In
• or
• Sign Up

’s monthly release of security fixes for the Windows operating system and other

This is the hidden content, please

• Sign In
• or
• Sign Up

software. It is also referred to as Update Tuesday.

The

This is the hidden content, please

• Sign In
• or
• Sign Up

Security Response Center publishes bulletins using the Common Vulnerabilities and Exposures (CVE) identification numbers for each vulnerability on the

This is the hidden content, please

• Sign In
• or
• Sign Up

website. Each bulletin gives remediation information and a link to a

This is the hidden content, please

• Sign In
• or
• Sign Up

Knowledge Base article with more details on the update.

Most Patch Tuesday updates correct vulnerabilities in the Windows desktop and server OS. They also fix issues in

This is the hidden content, please

• Sign In
• or
• Sign Up

Office applications, Azure hybrid cloud applications and the Visual Studio Code editor. The updates cover supported Windows systems, including Windows OSes that have reached end of life but have protection through

This is the hidden content, please

• Sign In
• or
• Sign Up

’s Extended Security Update program.

This is the hidden content, please

• Sign In
• or
• Sign Up

releases most of its security patches on Patch Tuesdays. Fixes for more serious vulnerabilities, called out-of-band patches, are the exception.

This is the hidden content, please

• Sign In
• or
• Sign Up

chose Tuesday to release patches because that gives IT ***** a day to prepare their systems.

When is Patch Tuesday?

Patch Tuesday occurs on the second Tuesday of each month at about 10 a.m. Pacific Time (5 p.m. Coordinated Universal Time). This is when

This is the hidden content, please

• Sign In
• or
• Sign Up

releases its monthly software updates. The company selected the Tuesday schedule to give administrators a dedicated day to prepare to deploy updates.

Until

This is the hidden content, please

• Sign In
• or
• Sign Up

introduced the cumulative update servicing model in 2016, administrators could choose to deploy individual patches. They could also decide to not install a security update and to roll back patches.

With Windows 10,

This is the hidden content, please

• Sign In
• or
• Sign Up

launched the Windows as a service cumulative update model. This approach compiles all security and nonsecurity updates for a month and all previous updates in a single package. With it, customers could no longer pick which updates they wanted to apply.

This is the hidden content, please

• Sign In
• or
• Sign Up

extended this Windows 10 servicing model to other supported versions of Windows OSes in late 2016. With this approach, Windows administrators can only decide the order of patch deployment, rather than select which patches to apply. If a system encounters an issue that cannot be remediated, the administrator must roll back the entire cumulative update until

This is the hidden content, please

• Sign In
• or
• Sign Up

issues a fix.

For Windows OS,

This is the hidden content, please

• Sign In
• or
• Sign Up

releases a monthly rollup on Patch Tuesday. It consists of that month’s security and reliability updates and includes all previously released updates.

This is the hidden content, please

• Sign In
• or
• Sign Up

calls this its B release.

This is the hidden content, please

• Sign In
• or
• Sign Up

offers cumulative, nonsecurity previews it calls the C release. The C release is typically published in the third or fourth week of the month. Administrators can test it on Windows systems before the official release on the following Patch Tuesday.

Other companies, such as Oracle and

This is the hidden content, please

• Sign In
• or
• Sign Up

, also have adopted patch deployment schedules that coincide with Patch Tuesday.

Why is patching important?

Regular patching provides the following advantages:

• Corrects software problems, including vulnerabilities, bugs and compatibility issues.
• Keeps software updated and functioning properly.
• Introduces features.

Patches provide protection from a range of security vulnerabilities including the following:

This is the hidden content, please

• Sign In
• or
• Sign Up

urges its customers to patch as soon as it releases these security updates. Malicious actors constantly scrutinize the code in

This is the hidden content, please

• Sign In
• or
• Sign Up

’s patches to gather clues to develop malware variants.

IT ***** must practice sound patch management to ensure the patches do not cause issues with other enterprise products or disrupt users. Best practices dictate that administrators use a testing phase, such as a pilot group, to check for problems before applying patches to systems in a production environment.

Patches can also introduce problems. Some IT ***** have given the Wednesday following Patch Tuesday the nickname “****** Wednesday” because that is when they must correct problems from the Tuesday patches.

How does

This is the hidden content, please

• Sign In
• or
• Sign Up

distribute patches?

This is the hidden content, please

• Sign In
• or
• Sign Up

describes its monthly fixes for Windows as a quality update that includes security fixes, bug corrections and feature refinements. The company combines security and nonsecurity releases in a monthly rollup, which it distributes in the following four ways:

1. Windows Update.
2. Windows Server Update Services.
3. System Center Configuration Manager.
4. This is the hidden content, please

   • Sign In
   • or
   • Sign Up
   Update Catalog.

For a time,

This is the hidden content, please

• Sign In
• or
• Sign Up

also distributed security updates for third-party applications. The most notable application in this category was the

This is the hidden content, please

• Sign In
• or
• Sign Up

Flash Player when it was still under

This is the hidden content, please

• Sign In
• or
• Sign Up

support.

What updates are released on Patch Tuesday?

The security updates

This is the hidden content, please

• Sign In
• or
• Sign Up

releases on Patch Tuesday are primarily for

This is the hidden content, please

• Sign In
• or
• Sign Up

software products, features and roles but also include apps that run on Apple and Android mobile devices.

This is the hidden content, please

• Sign In
• or
• Sign Up

uses a severity rating system that designates a patch as critical, important, moderate or low. Critical patches are for exploits that need no user action, such as the presence of a malicious network worm. Important patches need user interaction to trigger the exploit, such as opening a specially crafted file from an email.

A vulnerability that is under ******* without a patch is a zero-day exploit. That means researchers have found evidence of active exploitation before a patch is available. In these situations,

This is the hidden content, please

• Sign In
• or
• Sign Up

will often provide mitigation instructions to prevent exploitation until a security update is available. For example, the company might recommend changing certain values in a Windows registry key.

This is the hidden content, please

• Sign In
• or
• Sign Up

security updates apply to many types of software, including the following:

• Components in Windows OS.
• Applications on smartphones and tablets.
• Open source software projects.

Some of the products, features and roles that have security updates on a typical Patch Tuesday could include the following:

• Azure Open Management Infrastructure.
• This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  Business Central.
• This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  Accessibility Insights for Android.
• This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  Defender for IoT.
• This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  Edge for Android.
• This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  Office.
• This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  Windows Codecs Library.
• This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  Windows Domain Name System.
• Visual Studio.
• Windows BitLocker.
• Windows Common Log File System Driver.
• Event Tracing for Windows.
• Windows Installer.
• Windows Kernel.
• Windows Print Spooler Components.
• Windows Scripting.

This is the hidden content, please

• Sign In
• or
• Sign Up

typically stops publishing security fixes for products after the end-of-life date in the product’s support lifecycle. However,

This is the hidden content, please

• Sign In
• or
• Sign Up

deviated from its normal practices in 2017 and released patches for unsupported OSes to protect them from the WannaCry and EternalBlue ransomware attacks and variants based on that malware. Those unsupported OSes included Windows XP, Windows 8 and Windows Server 2003.

What are out-of-band patches?

An out-of-band patch is a software fix released outside of the Patch Tuesday schedule. These patches are released to stop the spread of critical vulnerabilities.

For example,

This is the hidden content, please

• Sign In
• or
• Sign Up

would release such a patch for a zero-day exploit that was considered a threat to many systems. It would release an out-of-band patch and an advisory to prompt users to take immediate action. If the patch applied to Windows OS,

This is the hidden content, please

• Sign In
• or
• Sign Up

would include it in the next Patch Tuesday as part of its cumulative update servicing model.

Patch Tuesday changes and Windows 10

In March 2017,

This is the hidden content, please

• Sign In
• or
• Sign Up

transitioned to the Security Update Guide, which focuses on the CVEs being targeted, regardless of the product. The update guide also introduced new application programming interfaces (APIs) for customers who want to automate some of the Patch Tuesday work.

This is the hidden content, please

• Sign In
• or
• Sign Up

also developed a PowerShell module called MsrcSecurityUpdates that works with an API to access security update data for jobs, such as building reports.

Windows 10 users can pause quality updates one time for up to 35 days.

Where can you find Patch Tuesday update details?

Users can find an overview of that month’s Patch Tuesday security updates in

This is the hidden content, please

• Sign In
• or
• Sign Up

Security Update Guide 

This is the hidden content, please

• Sign In
• or
• Sign Up

.

The Security Update Guide lists all security updates within a specified date range. It also lists the release date, the affected product, the vulnerability’s impact and its severity level. It includes a download link for the update and a link to corresponding

This is the hidden content, please

• Sign In
• or
• Sign Up

Knowledge Base articles and the CVE details of each patch.

A good place to get information about Patch Tuesday is

This is the hidden content, please

• Sign In
• or
• Sign Up

’s Security Update Guide Frequently Asked Questions page. The support policies for security updates are available in

This is the hidden content, please

• Sign In
• or
• Sign Up

’s Lifecycle Product Database.

This is the hidden content, please

• Sign In
• or
• Sign Up

releases security notifications whenever there are updates that affect customer security. Users with a

This is the hidden content, please

• Sign In
• or
• Sign Up

account can subscribe to email alerts.

This is the hidden content, please

• Sign In
• or
• Sign Up

also issues security advisories for security information that might not classify as a vulnerability but is still important.

Windows 10 users can check to see if their computers are up to date in the Windows Settings application under the Update & Security tab.

Patch Tuesday history

This is the hidden content, please

• Sign In
• or
• Sign Up

introduced Patch Tuesday in October 2003 to make patch deployment easier.

Until the introduction of the Security Update Guide in November 2017,

This is the hidden content, please

• Sign In
• or
• Sign Up

would publish security bulletins on its Security Advisories and Bulletins website for the vulnerabilities corrected in a month. The site broke down information for the month’s security updates by section: security bulletins, security bulletin summaries, security advisories and acknowledgments.

This is the hidden content, please

• Sign In
• or
• Sign Up

followed a regular monthly security update schedule until February 2017 when it cancelled the Patch Tuesday release because of a last-minute issue. It was the first time

This is the hidden content, please

• Sign In
• or
• Sign Up

had cancelled a Patch Tuesday release.

This is the hidden content, please

• Sign In
• or
• Sign Up

did not disclose what the issue was, but experts believe it was related to the U.S. National Security Agency’s (NSA) Windows exploits. Unknown threat actors had stolen information on those exploits and, later, the Shadow Brokers hacking group published it. According to reports, the NSA disclosed the exploits to

This is the hidden content, please

• Sign In
• or
• Sign Up

before their publication.

This is the hidden content, please

• Sign In
• or
• Sign Up

patched several critical vulnerabilities in the March 2017 Patch Tuesday, including the NSA’s Windows exploits.

Later in 2017,

This is the hidden content, please

• Sign In
• or
• Sign Up

changed the name, layout and the functionality of its security bulletins site and unveiled a new site with the Security Update Guide. Instead of the verbose bulletin-style format used to describe the vulnerabilities, customers can run searches and use date ranges to limit the vulnerabilities returned.

Users can search, filter and sort data to produce reports and export them to Excel. They can also find information more readily, such as whether a vulnerability is being actively exploited or has been publicly disclosed.

Ben Lutkevich is a site editor for Software Quality. Previously, he was a technical features writer for WhatIs.com, as part of the Learning Content team.

This is the hidden content, please

• Sign In
• or
• Sign Up

#Patch #Tuesday

This is the hidden content, please

• Sign In
• or
• Sign Up