May 2023 Patch Tuesday forecast: Dealing with End-of-Support (EOS)

The April Patch Tuesday releases were unusual because we saw a whopping 62 vulnerabilities addressed in the Microsoft Server 2012 KBs. Granted there was a lot of overlap with the CVEs addressed in Windows 10 and 11, but compared to the typical 30-40 CVEs addressed in the months prior, this number was unusually aggressive.

May 2023 Patch Tuesday forecast

Is this a coincidence or is there a push to prepare Server 2012 for its upcoming EOS in October? There are several Microsoft operating systems in the same situation, and there are often challenges on what to do as that fateful day approaches.

End-of-Support (EOS)

Many industries are reliant on highly specialized applications, which were often written for a particular operating system. When that operating system, like Microsoft Server 2012, is coming to EOS, you may have limited choices. If there is no upgrade path due to an OS dependency or perhaps lack of funding to upgrade, you are forced to look at mitigating options. It all comes down to control and containment of these systems you know will be more vulnerable as time passes.

Each situation is unique, but options to consider include minimized user privileges, virtualized workloads, reduced exposure to neighboring systems, removal from direct Internet access, application whitelisting, or even containerization. Regardless of the approach taken, it is important to plan in advance, so you are not caught short on time and options as the end nears.

With that in mind, Microsoft Windows 10 20H2 for Education and Enterprise reaches end-of-support (EOS) this month, and Windows 10 21H2 Home and Professional will reach EOS in June, so plan accordingly. Microsoft reiterated in a blog that Windows 10 22H2 is the final feature version of Windows 10 and that all editions will receive security updates through October 14, 2025. Additional support information for all versions of Windows 10 is consolidated here.

Microsoft Defender Antivirus

In other Microsoft news, a fix for KB5007651 “Update for Microsoft Defender Antivirus antimalware platform – (Version 1.0.2302.21002)” is now available. After the original KB was installed, Windows 11 users were seeing the message “Local Security Authority protection is off. Your device may be vulnerable.” The error would persist even after a reboot and confirmation that Local Security Authority was still enabled. Based on the issue resolution update, the reissued KB fixes the issue.

Apple Rapid Security Response

Apple recently announced they will be offering Rapid Security Responses for the latest operating system versions on iPhone, iPad, and macOS. Each update will be designated with (a), (b), etc., following the applicable OS version number. These updates will be released as needed to address hot security issues and all will be rolled up into the next major release for each operating system or application.

Google Chrome

Google has been very busy with software updates this past month. Immediately following April Patch Tuesday, they released an emergency hot fix for Google Chrome 112. This was to address a zero-day known exploit of CVE-2023-2033 associated with the Chrome V8 JavaScript engine. They’ve since followed up with Extended Stable channel update 112.0.5615.179 for Windows and Mac, as well as a Stable Channel Update for Desktop 113 for Windows, Mac and Linux. This later release addressed 15 vulnerabilities, of which 10 were attributed to external researchers.