Security Update Package Installer 3.3.4 release notes

🆕 New features

There are no new features in this release.

✨ Enhancements

There are no enhancements in this release.

🛠️ Issues resolved

Product area	Description	Resolution
Security	An update package could be altered after it passed a security check.	Update packages are now protected from tampering after they're verified.
Security	Certain update processes were vulnerable to attacks that could run unauthorized commands.	These processes are now protected against this type of attack.
Security	Update files and logs had overly open permissions, allowing unauthorized access.	File and folder permissions are now properly restricted.
Security	Some update scheduling features could be accessed without logging in.	These features now require proper authentication.
Security	Update status notifications could be sent by unauthorized users.	Notifications now require proper authentication.
Security	A data lookup feature was vulnerable to unauthorized database access.	This feature is now protected against unauthorized access.
Security	The check that verifies a trusted software publisher could be tricked.	This check now correctly verifies the publisher's identity.
Security	An update process could install files that weren't properly verified.	All files are now verified before installation.
Security	Unexpected input could cause the update service to crash.	The service now handles unexpected input without crashing.
Security	Update files could be extracted to unintended locations.	Files are now extracted only to their intended location.
Security	A cleanup process could remove the wrong folder.	Cleanup now only affects the correct folder.
Security	A safeguard against files being placed outside their intended folder could be bypassed.	This safeguard is now more reliable and cannot be bypassed.
Security	Update packages signed with a revoked security certificate could still be trusted.	Revoked certificates are no longer trusted.
Security	Some older update files were automatically trusted without proper verification.	All update files are now consistently verified.
Security	A system utility could be tricked into writing log data to the wrong location.	This utility now writes logs to a secure location.
Security	Some network communications didn't properly verify the server they connected to.	These communications now properly verify the destination server.
Security	A feature that checks for new updates could be triggered without authorization.	This feature now requires proper authentication.
Security	Internal communication used to verify user sessions didn't fully confirm the other party's identity.	This communication now properly verifies identity.
Security	A permissions check always reported users as administrators, regardless of their actual access level.	This check now correctly reflects each user's actual access level.
Security	A critical update feature, including the ability to restart the system, could be triggered without authorization.	This feature now requires proper authentication.
Upgrade	A required update step could be permanently skipped if it wasn't needed yet when the update was downloaded, even if it became needed later.	This step is now checked again right before installation.
Upgrade	An update step could fail if it ran before Windows finished processing the previous update after a restart.	The system now waits for Windows to finish before continuing.
Upgrade	On some Windows Server 2016 systems, an unexpected restart during an update could prevent later security updates from installing.	Updates now install successfully even after this type of restart.