April’s Patch Tuesday: a lot of large, diverse and urgent updates

This week’s Patch Tuesday release was huge, diverse, risky, and urgent, with late update arrivals for Microsoft browsers (CVE-2022-1364) and two zero-day vulnerabilities affecting Windows (CVE-2022-26809 and CVE-2022-24500). Fortunately, Microsoft has not released any patches for Microsoft Exchange, but this month we do have to deal with more Adobe (PDF) printing related vulnerabilities and associated testing efforts. We have added the Windows and Adobe updates to our “Patch Now” schedule, and will be watching closely to see what happens with any further Microsoft Office updates. 

As a reminder, Windows 10 1909/20H2 (Home and Pro) will reach their end of servicing dates on May 10. And if you are looking for an easy way to update your server-based .NET components, Microsoft now has .NET auto-update updates for servers. You can find more information on the risk of deploying these Patch Tuesday updates in this useful infographic.

Key testing scenarios

Given what we know so far, there are three reported high-risk changes included in this month’s patch release, including:

• Printer update(s) to the SPOOL component, which may affect page printing from browsers and graphically dense images.
• A network update to named pipes that may cause issues with Microsoft’s remote desktop services.

More generally, given the large number and diverse nature of the changes for this month’s cycle, we recommend testing the following areas:

• Test your DNS Zone and Server Scope operations if used on your local servers (DNS Manager);
• Test printing PDFs from your browsers (both desktop and server);
• Test your FAX (Castelle anyone?) and telephone (telephony) based applications;
• And install, repair, and uninstall your core application packages (this probably should be automated, with a baseline data for detailed analysis).

Microsoft has updated a number of APIs, including key file and kernel components (FindNextFile, FindFirstStream and FindNextStream). Given the ubiquity of these common API calls, we suggest creating a server stress test that employs very heavy local file loads and pay particular attention to the Windows Installer update that requires both install and uninstall testing. Validating application uninstallation routines has fallen out of vogue lately due to improvements with application deployment, but the following should be kept in mind when applications are removed from a system:

• Does the application uninstall? (Files, registry, shortcuts, services, and environment settings);
• Does the uninstall process remove components from applications or shared resources?
• Are any key resources (system drivers) removed, and do other applications have shared dependencies?

I have found that keeping application uninstallation Installer logs and comparing (hopefully the same) information across updates is probably the only accurate method — “eyeballing” a cleaned system is not sufficient. And finally, given the changes to the kernel in this update, test (smoke test) your legacy applications. Microsoft has now included deployment and reboot requirements in a single page.