September 2020 Microsoft Security Guide

[Freddie_Jimenez]

October Update - September's testing of patches is deemed complete, and there have been no known issues reported by testing teams relating to any of the Hyland products.'

The following is a summary of Microsoft's Security Bulletin Guide for September, 2020. Hyland has downloaded these patches and applied them to our R&D Infrastructure. We will be performing Software Change Requests, automated, and regression testing in environments containing these patches over the next month. If no issues have been found or reported, we will deem testing to be complete.

The testing is not all-inclusive; issues may still be found upon implementation. Follow best practices for testing and installing software updates/patches in a development environment before implementing the updates in a production environment. Where applicable, the updates are tested on all supported Windows platforms with the latest OnBase® version.

Release Notes

September 2020 Security Updates

Release Date: September 08, 2020

The September 2020 security release consists of security updates for the following software:

• Microsoft Windows
• Microsoft Edge (EdgeHTML-based)
• Microsoft Edge (Chromium-based)
• Microsoft ChakraCore
• Internet Explorer
• SQL Server
• Microsoft JET Database Engine
• Microsoft Office and Microsoft Office Services and Web Apps
• Microsoft Dynamics
• Visual Studio
• Microsoft Exchange Server
• SQL Server
• ASP.NET
• Microsoft OneDrive
• Azure DevOps

Please note the following information regarding the security updates:

• For information regarding enabling Windows 10, version 1909 features, please see Windows 10, version 1909 delivery options. Note that Windows 10, versions 1903 and 1909 share a common core operating system with an identical set of system files. They will also share the same security update KBs.
• Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are available via the Microsoft Update Catalog.
• For information on lifecycle and support dates for Windows 10 operating systems, please see Windows Lifecycle Facts Sheet.
• A list of the latest servicing stack updates for each operating system can be found in ADV990001. This list will be updated whenever a new servicing stack update is released. It is important to install the latest servicing stack update.
• Updates for Windows RT 8.1 and Microsoft Office RT software are only available via Windows Update.
• In addition to security changes for the vulnerabilities, updates include defense-in-depth updates to help improve security-related features.
• Customers running Windows 7, Windows Server 2008 R2, or Windows Server 2008 need to purchase the Extended Security Update to continue receiving security updates. See 4522133 for more information.
• There is a change coming with regards to Servicing Stack Updates. Please see Simplifying SSUs for more information.

The following CVEs have FAQs with additional information and may include * further steps to take after installing the updates. Please note that this is not a complete list of CVEs for this release.

• CVE-2020-0664
• CVE-2020-0856
• CVE-2020-0875
• CVE-2020-0914
• CVE-2020-0921
• CVE-2020-0928
• CVE-2020-0941
• CVE-2020-0989
• CVE-2020-1031
• CVE-2020-1033
• CVE-2020-1083
• CVE-2020-1091
• CVE-2020-1097
• CVE-2020-1119
• CVE-2020-1193
• CVE-2020-1210
• CVE-2020-1218
• CVE-2020-1224
• CVE-2020-1250
• CVE-2020-1256
• CVE-2020-1332
• CVE-2020-1335
• CVE-2020-1338
• CVE-2020-1589
• CVE-2020-1592
• CVE-2020-1594
• CVE-2020-1596 *
• CVE-2020-16851 *
• CVE-2020-16852 *
• CVE-2020-16853 *
• CVE-2020-16854
• CVE-2020-16855
• CVE-2020-16879
• CVE-2020-16884 *

Known Issues reported by Microsoft

The following KBs contain information about known issues with the security updates. For a complete list of security update KBs, please see 20200908. For more information about Windows Known Issues, please see Windows message center (links to currently-supported versions of Windows are in the left pane).

KB Article	Applies To
4484488	SharePoint Foundation 2013
4484515	SharePoint Enterprise Server 2013
4486667	SharePoint Foundation 2010
4570333	Windows 10 Version 1809, Windows Server 2019
4571756	Windows 10, version 2004
4574727	Windows 10, version 1903, Windows Server version 1903, Windows 10, version 1909, Windows Server version 1909
4577015	Windows 10, version 1607, Windows Server 2016
4577038	Windows Server 2012 (Monthly Rollup)
4577048	Windows Server 2012 (Security-only update)
4577051	Windows 7, Windows Server 2008 R2 (Monthly Rollup)
4577053	Windows 7, Windows Server 2008 R2 (Security-only update)
4577064	Windows Server 2008 Service Pack 2 (Monthly Rollup)
4577066	Windows 8.1, Windows Server 2012 R2 (Monthly Rollup)
4577070	Windows Server 2008 Service Pack 2 (Security-only update)
4577071	Windows 8.1, Windows Server 2012 R2 (Security-only update)
4577352	Exchange Server 2019, Exchange Server 2016
4484505	SharePoint Server 2019
4484506	SharePoint Enterprise Server 2016
4484525	SharePoint Foundation 2013

Hyland Software - Microsoft Updates Statement 

Hyland Software is dedicated to ensuring the monthly cumulative updates released by Microsoft® are compatible with OnBase®. On the second Tuesday of each month, the Quality Assurance Department of Hyland Software evaluates the cumulative fixes released and labeled as Critical or Important by Microsoft®. The details of the update provided by Microsoft are reviewed for interaction with OnBase® and installed when appropriate for testing its compatibility with OnBase®.