(11-Jan-2018) MBSA Detection for Specter / Meltdown Vulnerbility Windows Patch

Question

so I'm running Microsoft Baseline Security Analyzer for Jan 18. I realize it does not flag out the KB required to address the specter/meltdown vulnerbility.

The KB in question here is KB4056897, I realize the failure to detect could be due to the missing registry key as stated in the following link:

(https://community.spiceworks.com/topic/2103560-meltdown-update-kb4056897-not-applicable-for-windows-7-machines)

Upon doing further research it seems MBSA is also dependent on the windows registry key for its patch detection.

(https://biztechmagazine.com/article/2011/04/be-proactive-microsofts-baseline-security-analyzer)

My questions are thus:

1. Does all user need to include this registry key for MBSA to perform correctly?
2. Is there an official bulletin for MBSA stating point 1?

Answer 1

1. Does all user need to include this registry key for MBSA to perform correctly?

Even if the registry is to be set, it is to be done once per system. The registry which is to be set will be applicable system wide.

Now coming to the point of setting up the registry; YES, you'd have to set up the registry either manually, or using Antivirus (if you've one which is compatible and supports this), or by using Group Policy in AD.

2. Is there an official bulletin for MBSA stating point 1?

Yes, in the Microsoft's Advisory chapter "Important: Windows security updates released January 3, 2018, and antivirus software", they have explicitly mentioned this line:

Windows Defender Antivirus, System Center Endpoint Protection, and Microsoft Security Essentials are compatible with the January 2018 security updates and have set the required registry key.

.........................................................

Customers without Antivirus

In cases where customers can’t install or run antivirus software, Microsoft recommends manually setting the registry key as described below in order to receive the January 2018 security updates.

Setting the Registry Key

Note: Customers will not receive the January 2018 security updates (or any subsequent security updates) and will not be protected from security vulnerabilities unless their antivirus software vendor sets the following registry key:

Key="HKEY_LOCAL_MACHINE"
Subkey="SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat"
Value="cadca5fe-87d3-4b96-b7fb-a231484277cc" Type="REG_DWORD”
Data="0x00000000”

As you can see, there is no inclusion/mention of MBSA in the article, which means that someone has to do the setting of the registry manually to get the January, 2018 Windows updates, given that the prerequisites are set.