MS16-111: Description of the security update for Windows Kernel: September 13, 2016

Applies to: Windows Server 2012 R2 DatacenterWindows Server 2012 R2 StandardWindows Server 2012 R2 Essentials

Summary

This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker runs a specially crafted application on a target system.

To learn more about the vulnerability, see Microsoft Security Bulletin MS16-111.

Known issues in this update

  • Known issue 1

    After you install this update, you may encounter 0xC0000022 NTLM authentication errors. To resolve this issue, see NTLM authentication fails with 0xC0000022 error for Windows Server 2012, Windows 8.1, and Windows Server 2012 R2 after update is applied.
  • Known issue 2

    Symptoms

    Assume that you are running Enhanced Mitigation Experience Toolkit (EMET) on Windows 7 Service Pack 1 (SP1) on a computer on which update 3175024 is installed. When you try to start an application, the application freezes very early in the process and does not completely start.

    Cause

    This issue occurs because the Export Address table Filtering (EAF) mitigation is active on the application.

    Workaround

    To work around this issue, use one of the following methods to disable the EAF mitigation on all applications.

    Method 1

    Select a running process in EMET, press and hold (or right-click) Configure Process, and then clear the EAF check box on each running application. The following screen shots show these steps.

    The screen shot to click Configure Process

    The screen shot to clear the EAF check box


    Method 2

    In Group Policy, add an Application Configuration Group Policy setting that disables EAF for all processes by using an asterisk (*) as a wildcard character for the value name.

    The screen shot to add an Application Configuration Group Policy

    Status

    This issue is resolved in EMET 5.5, 5.51 and 5.52.  If you are experiencing this issue, we recommend that you upgrade to EMET version 5.52.

More Information

Important

  • All future security and non-security updates for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 require update 2919355 to be installed. We recommend that you install update 2919355 on your Windows RT 8.1-based, Windows 8.1-based, or Windows Server 2012 R2-based computer so that you receive future updates.
  • If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see Add language packs to Windows.

How to obtain and install the update

Method 1: Windows Update

This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see Get security updates automatically.

Note For Windows RT 8.1, this update is available through Windows Update only.

Method 2: Microsoft Update Catalog

To get the stand-alone package for this update, go to the Microsoft Update Catalog website.

More Information

File Information