{"id":1248,"date":"2016-08-12T00:57:00","date_gmt":"2016-08-11T22:57:00","guid":{"rendered":"http:\/\/borncity.com\/win\/?p=1248"},"modified":"2024-10-01T15:06:00","modified_gmt":"2024-10-01T13:06:00","slug":"ie-11-security-updates-junejuly-2016-are-causing-issues","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2016\/08\/12\/ie-11-security-updates-junejuly-2016-are-causing-issues\/","title":{"rendered":"IE 11 security updates June\/July 2016 are causing issues"},"content":{"rendered":"

[German<\/a>]Microsoft has issued some security updates in June and July 2016 for Internet Explorer 11. Blog reader Axel H. has observed serious issues within his intranet with Sharepoint. Some Web sites are rendered wrong and it seems that other admins are facing also trouble. <\/p>\n

<\/p>\n

\"\"Currently I can only cumulate what I've found. Some SAP users are reporting login issues after installing IE 11 security updates. Others are facing trouble with rendering some web pages in IE 11 enterprise mode. At August 3, 2016 Axel send me an e-mail summarizing his observations. Here is an excerpt. <\/p>\n

\n

after installing cumulative IE 11 updates June\/July 2016, some web pages in Intranet can't be opened, and on some SharePoint pages the context has been rendered in \"shifted mode\". <\/p>\n

MS16-063 (June) and\/or MS16-084 on W7 clients  and the corresponding Cumulative updates for Windows 10 has been installed. IE version is either 11.0.32 (June) or 11.0.33 (July). Version 11.0.31 doesn't make trouble. After uninstalling the last IE security updates, everything seems fine again. There has been only two websites, addressing similar issues: <\/p>\n

Windows update KB3170106 messes up sharepoint<\/a>
An update to our SHA-1 deprecation roadmap<\/a><\/p>\n<\/blockquote>\n

Later on Axel send me further details. He found some comments in SAP user forums, where login has changed for SAP software. Here are the links. <\/p>\n

\n

update KB3170106 which changed the way ASP objects are handled<\/a>
windows 10 update 15 Jun 2016<\/a>
Could not establish secure channel for SSL\/TLS with authority<\/a>
June 2016 Update KB3163018 \u2013 TLS 1.0 support removed\/blocked?<\/p>\n<\/blockquote>\n

This posts confirms, that IE 11 updates like KB31616086 and KB3161608 are causing issues, because server certificates are exchanged. Some admins are reporting SSL errors that will be gone after uninstalling the updates. <\/p>\n

SAP login issues<\/h3>\n

Axel has send me the link Server's Security Certificate Windows 7<\/a> addressing SAP software. He has added a SAP document dealing with this issue. Below is a screenshot of the PDF document (the content is only a graphic). <\/p>\n

\"SAP<\/a> <\/p>\n

The site SAP B1 \u2013 There is a problem with the server's security certificate \u2013 Windows 10<\/a> deals with the same issue and recommends to uninstall KB3163017\/KB3163018. SAP recommends to switch to the newest Business One clients. <\/p>\n

First workaround<\/h3>\n

Because we are dealing with security updates for IE 11, uninstalling these patches isn't the best choice. Axel found some hints. He wrote: <\/p>\n

\n

The SharePoint issues could be tracked down to the Enterprise Mode site list. But HP Service Manager won't work anymore in W10 Patch. The assumption was that it's a TLS 1.0+SHA-1 handshake error.<\/p>\n<\/blockquote>\n

One of his colleagues found more details. KB3161639<\/a> adds two Cipher suites, and those entries change the order of certificates. Deleting: <\/p>\n

\n

TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA<\/p>\n<\/blockquote>\n

in HKLM\\SYSTEM\\CurrentControlSet\\Control\\Cryptography\\
Configuration\\Local\\SSL\\00010002 enables access to Web pages in Windows 10 clients. At August 10, 2016 Axel added: <\/p>\n

\n

According to https:\/\/technet.microsoft.com\/library\/security\/3042058.aspx<\/a> Microsoft has changed the priority of entries in Cipher suites. Changing the position of entries within the list changes also its priorities. Under Windows 10 they moved entry <\/p>\n

TLS_RSA_WITH_AES_128_CBC_SHA<\/p>\n<\/blockquote>\n

\n

in above the new entries <\/p>\n

TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA <\/p>\n

and HP ServiceManager was useable again. <\/p>\n

The liste of \u201eCipher Suites\" on this Microsoft page<\/a> looks a bit different from our list. We fear that new patches will change the priorities and list order again. Therefore we are searching for different solutions. <\/p>\n<\/blockquote>\n

Axel has added the following links to pages covering the topic:<\/p>\n

https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/aa374757(v=vs.85).aspx<\/a>
https:\/\/msdn.microsoft.com\/library\/windows\/desktop\/mt767769.aspx<\/a>
https:\/\/blogs.technet.microsoft.com\/windowsitpro\/2016\/05\/17\/simplifying-updates-for-windows-7-and-8-1\/<\/a><\/p>\n

If someone has further thoughs\/insides or hints, feel free to crop a comment.<\/p>\n","protected":false},"excerpt":{"rendered":"

[German]Microsoft has issued some security updates in June and July 2016 for Internet Explorer 11. Blog reader Axel H. has observed serious issues within his intranet with Sharepoint. Some Web sites are rendered wrong and it seems that other admins … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[44,166,100,194],"class_list":["post-1248","post","type-post","status-publish","format-standard","hentry","category-update","tag-ie-11","tag-issues","tag-updates","tag-windows"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/1248","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=1248"}],"version-history":[{"count":1,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/1248\/revisions"}],"predecessor-version":[{"id":35088,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/1248\/revisions\/35088"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=1248"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=1248"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=1248"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}