Kb2992611 windows 7 x32

Secure and Fast Download — Software Verified

System Requirements

Operating Systems: Windows 7 Service Pack 1

Installation Instructions

Related Resources

• Microsoft Security Bulletin

(updated 11/18 for re-issue, see below)

Microsoft released one of the most important patches in many years on
Tuesday, and while I would advise you install it right away I also want to
make you aware of some odd behavior I found that could lead to problems.
First, a primer:

Картинка с сайта: blog.ittoby.com

Here
are the release notes and here
is more information. This is the worst kind of exploit there can be; a
remote code execution with no workarounds. If one knew the details, they
could easily exploit any Microsoft based internet facing server supporting
TLS and then turn around and use it to infect unpatched Windows based
clients. Obviously you should patch immediately.

That said, you will notice that they mention the addition of four new
cipher suites but there is one other change that may impact you that is
not mentioned. I’ve found that this patch also re-orders the cipher
suites. Historically Microsoft has notified customers when re-ordering
cipher suites; see KB2919355
for example.

This is important to understand for two reasons, one theoretical and one
practical.

• Theoretical is that changing cipher suites impacts your security
  posture, and one should always know these things going into a patch.
  Fortunately most of the re-order does seem in line with a tighter
  security policy.
• Practical is that this can break connectivity with some applications.
  Specifically, one of my peers found that Java 6 based applications
  attempting purposely or otherwise to use the ECDH
  key agreement protocol will fail to connect. This happens when Windows
  based services present ECDH before the older RSA. Side note:
  Oddly the Microsoft JDBC driver tries to negotiate SSL even if it isn’t
  being used for a connection to SQL.

Here are the cipher suite details, first 2008 R2:

And 2012 (not R2):

2012 R2 is unchanged since the aforementioned April patch.

The point is that you should ensure your applications & clients don’t
have an issue with the cipher suite re-order. It’s unlikely that your apps
will have a problem but worthwhile to do a quick connectivity check in a
test environment to be sure. If you do have issues you can re-order your
suites after the patch by manipulating the registry keys listed here
(not necessarily deleting the keys they list);  use the before/after
information above for reference. For more information about prioritizing
cipher suites, see this.

It’s unfortunate that they didn’t communicate this change as it may have
unanticipated impacts. Here’s hoping they return to their generally good
communication in the next cycle.

Update 11/18/2014:

As I’m sure you’ve heard, Microsoft has released
three patches today, one of which is a re-issue of the patch mentioned
in this post. The re-issue removes the four newly added cipher suites as
there have been multiple problems reported with them. Microsoft also updated
their article to
include the following statement:

«Customers who customized their cipher suite priority list should review
their list after they apply this update to make sure that the sequence
meets their expectations.

Removing these cipher suites does not affect the security updates that are
part of this release. On November 18, 2014, a new secondary package was
added to the release for Windows Server 2008 R2 and Windows Server 2012 to
achieve this. This new package is update 3018238, and it will install
automatically and transparently together with security update 2992611. It
will appear separately in the list of installed updates. If you already
have security update 2992611 installed, you will notice that security
update 2992611 will be reoffered (for Windows Server 2008 R2 or Windows
Server 2012 only) by Windows Update or by Windows Server Update Services
(WSUS) to make sure that update 3018238 is also installed.

The cipher suites may be re-added to the default priority list in a future
release after the community has had an opportunity to make sure of correct
execution in all customer scenarios.

«

I’ve just re-applied the newly released patches using WSUS to evaluate them.
Note that you must re-appy using the same method you originally applied
with, meaning that if you downloaded manually you would need to repeat that,
and if you applied via WSUS you would need to use that methodology. Upon
reviewing the «new» cipher suite order I was both surprised and happy with
what I found:

And now 2012:

Again, no changes for 2012 R2. If the above looks familiar, good eye.
They’re the same as pre-patch:

Server 2008 «patch 2» vs. no patch:

Server 2012 «patch 2» vs. no patch:

So as it pertains to the cipher suite order, we’re right back where we
started. I’m sure this will alleviate some of the issues some customers
encountered. Keep in mind that there is more to this patch (binaries) than
the cipher suite re-order, so to echo the previous assesment it should be
installed.