CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
73.9%
View products that this article applies to.
This security update resolves a security feature bypass vulnerability that exists when Microsoft .NET Framework and .NET Core components do not completely validate certificates. This security update addresses the vulnerability by helping to make sure that .NET Framework and .NET Core components completely validate certificates. To learn more about this vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2018-0786.Additionally, this security update resolves a denial of service vulnerability that exists when .NET Framework and .NET core components improperly process XML documents. This update addresses the vulnerability by correcting how .NET Framework and .NET Core component applications handle XML document processing. To learn more about this vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2018-0764.Important
When certificates are used for authentication, the authenticator examines the certificate that is provided by the remote endpoint and seeks the correct purpose object identifier in Application Policies extensions. When a certificate is used for client authentication, the object identifier for Client Authentication must be present in the EKU extensions of the certificate, or authentication fails. The object identifier for Client Authentication is 1.3.6.1.5.5.7.3.2. Likewise, when a certificate is used for server authentication, the object identifier for Server Authentication must be present in the EKU extensions of the certificate, or authentication fails. The object identifier for Server Authentication is 1.3.6.1.5.5.7.3.1. Certificates that have no EKU extension continue to authenticate correctly.
First, consider making changes to your component’s certificates to make sure that they are using the correct EKU OID attributes and are secured correctly. If you temporarily cannot access correctly reissued certificates, you can choose to opt in or out of the security change to avoid any connectivity effects. To do this, specify the following appsetting in the configuration file:`
<appSettings>
<add key=“wcf:useLegacyCertificateUsagePolicy” value=“true” />
</appSettings>
`Note Setting the value to “true” will opt out of the security changes.
To get the stand-alone package for this update, go to the Microsoft Update Catalog.
On your WSUS server, follow these steps:
For deployment details for this security update, go to the following article in the Microsoft Knowledge Base:20180109 Security update deployment information: January 9, 2018
Note We do not recommend that you remove any security update. To remove this update, use thePrograms and Features item in Control Panel.
This update does not require a system restart after you apply it unless files that are being updated are locked or are being used.
This update replaces update KB 3122655.
Package name | PackageHashSHA1 | PackageHashSHA2 |
---|---|---|
Windows8-RT-KB4054171-x64.msu | F32C467A5AE5924D33324A8D089F5C72EE866208 | 3B9E3785A1600E1A2BFC18A5C9751FF0C29282598243F3C612A73D205BD0267A |
Windows8-RT-KB4054171-x86.msu | A2A9402C56EEEC4F110821EDD05C8A0C3DF02E42 | 3B0C011F774D1549473B1C2C54C1A0E4C4A266F0866A9581A7237775E252A60E |
The English (United States) version of this hotfix installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time together with your current daylight-saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.For all x86-based systemsFile name | File version | File size | Date | Time |
---|---|---|---|---|
smdiagnostics.dll | 4.0.30319.36427 | 73,376 | 01-Dec-2017 | 13:05 |
system.activities.dll | 4.0.30319.36427 | 1,582,768 | 01-Dec-2017 | 13:05 |
system.data.sqlxml.dll | 4.0.30319.36427 | 752,320 | 01-Dec-2017 | 13:05 |
system.identitymodel.services.dll | 4.0.30319.36427 | 199,904 | 01-Dec-2017 | 13:05 |
system.identitymodel.dll | 4.0.30319.36427 | 1,093,832 | 01-Dec-2017 | 13:05 |
system.runtime.serialization.dll | 4.0.30319.36427 | 1,060,088 | 01-Dec-2017 | 13:05 |
system.servicemodel.channels.dll | 4.0.30319.36427 | 159,608 | 01-Dec-2017 | 13:05 |
system.servicemodel.discovery.dll | 4.0.30319.36427 | 312,704 | 01-Dec-2017 | 13:05 |
system.servicemodel.internals.dll | 4.0.30319.36427 | 254,720 | 01-Dec-2017 | 13:05 |
system.servicemodel.washosting.dll | 4.0.30319.36427 | 39,656 | 01-Dec-2017 | 13:05 |
system.servicemodel.dll | 4.0.30319.36427 | 6,386,368 | 01-Dec-2017 | 13:05 |
system.xml.dll | 4.0.30319.36427 | 2,705,040 | 01-Dec-2017 | 13:05 |
msvcp120_clr0400.dll | 12.0.52430.36430 | 536,744 | 12-Dec-2017 | 19:05 |
msvcr120_clr0400.dll | 12.0.52430.36430 | 875,688 | 12-Dec-2017 | 19:05 |
servicemodel.mof | 88,383 | 15-Nov-2017 | 00:50 | |
servicemodel.mof.uninstall | 896 | 15-Nov-2017 | 00:50 | |
servicemonikersupport.dll | 4.0.30319.36366 | 28,376 | 15-Nov-2017 | 00:50 |
For all x64-based systemsFile name | File version | File size | Date | Time |
— | — | — | — | — |
msvcp120_clr0400.dll | 12.0.52430.36430 | 678,568 | 12-Dec-2017 | 19:06 |
msvcr120_clr0400.dll | 12.0.52430.36430 | 869,544 | 12-Dec-2017 | 19:06 |
servicemodel.mof | 88,383 | 15-Nov-2017 | 00:49 | |
servicemodel.mof.uninstall | 896 | 15-Nov-2017 | 00:49 | |
servicemonikersupport.dll | 4.0.30319.36366 | 28,888 | 15-Nov-2017 | 00:49 |
smdiagnostics.dll | 4.0.30319.36427 | 73,376 | 01-Dec-2017 | 13:13 |
system.activities.dll | 4.0.30319.36427 | 1,582,768 | 01-Dec-2017 | 13:13 |
system.data.sqlxml.dll | 4.0.30319.36427 | 752,320 | 01-Dec-2017 | 13:13 |
system.identitymodel.services.dll | 4.0.30319.36427 | 199,904 | 01-Dec-2017 | 13:13 |
system.identitymodel.dll | 4.0.30319.36427 | 1,093,832 | 01-Dec-2017 | 13:13 |
system.runtime.serialization.dll | 4.0.30319.36427 | 1,060,088 | 01-Dec-2017 | 13:13 |
system.servicemodel.channels.dll | 4.0.30319.36427 | 159,608 | 01-Dec-2017 | 13:13 |
system.servicemodel.discovery.dll | 4.0.30319.36427 | 312,704 | 01-Dec-2017 | 13:13 |
system.servicemodel.internals.dll | 4.0.30319.36427 | 254,720 | 01-Dec-2017 | 13:13 |
system.servicemodel.washosting.dll | 4.0.30319.36427 | 39,656 | 01-Dec-2017 | 13:13 |
system.servicemodel.dll | 4.0.30319.36427 | 6,386,368 | 01-Dec-2017 | 13:13 |
system.xml.dll | 4.0.30319.36427 | 2,705,040 | 01-Dec-2017 | 13:13 |
smdiagnostics.dll | 4.0.30319.36427 | 73,376 | 01-Dec-2017 | 13:05 |
system.activities.dll | 4.0.30319.36427 | 1,582,768 | 01-Dec-2017 | 13:05 |
system.data.sqlxml.dll | 4.0.30319.36427 | 752,320 | 01-Dec-2017 | 13:05 |
system.identitymodel.services.dll | 4.0.30319.36427 | 199,904 | 01-Dec-2017 | 13:05 |
system.identitymodel.dll | 4.0.30319.36427 | 1,093,832 | 01-Dec-2017 | 13:05 |
system.runtime.serialization.dll | 4.0.30319.36427 | 1,060,088 | 01-Dec-2017 | 13:05 |
system.servicemodel.channels.dll | 4.0.30319.36427 | 159,608 | 01-Dec-2017 | 13:05 |
system.servicemodel.discovery.dll | 4.0.30319.36427 | 312,704 | 01-Dec-2017 | 13:05 |
system.servicemodel.internals.dll | 4.0.30319.36427 | 254,720 | 01-Dec-2017 | 13:05 |
system.servicemodel.washosting.dll | 4.0.30319.36427 | 39,656 | 01-Dec-2017 | 13:05 |
system.servicemodel.dll | 4.0.30319.36427 | 6,386,368 | 01-Dec-2017 | 13:05 |
system.xml.dll | 4.0.30319.36427 | 2,705,040 | 01-Dec-2017 | 13:05 |
msvcp120_clr0400.dll | 12.0.52430.36430 | 536,744 | 12-Dec-2017 | 19:05 |
msvcr120_clr0400.dll | 12.0.52430.36430 | 875,688 | 12-Dec-2017 | 19:05 |
servicemonikersupport.dll | 4.0.30319.36366 | 28,376 | 15-Nov-2017 | 00:50 |
This article applies to the following:
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
73.9%