Updates for SharePoint Server 2016 (September 2023 CU)

17.9.2023    |    komentáře   komentářů: 0

A new cumulative update (September 2023 CU) has been released for SharePoint Server 2016.

This CU includes both Feature Pack 2, available since the September CU (September 2017 CU), and the earlier Feature Pack 1.

SP Build:
16.0.5413.1001 (Language independent CU)
16.0.5413.1000 (Language dependent CU)

SharePoint 2016 CU – KB articles describing the CU:

  • KB 5002494 – September 2023 Update for SharePoint Server 2016 (language independent)
  • KB 5002501 – September 2023 Update for SharePoint Server 2016 (language dependent)

SharePoint Server 2016 CU – CU download links:

After installation, remember to run the SharePoint 2016 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

  1. language independent components (core CU)
  2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2016 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

Both KB5002494 and KB5002501 require the release version of SharePoint Enterprise Server 2016.

Enabling the modern OneDrive for Business experience requires an active Software Assurance contract, whether enabled by this update or manually. Without an active contract at enablement, disable this experience.

The default AMSI activation takes effect after installing the update and running the Products Configuration Wizard. Skipping this CU defers activation until a later CU containing these changes. For this release, AMSI can subsequently be disabled through the web application’s Manage Features screen; later public updates then do not attempt to re-enable it.

Custom ASPX web parts may be blocked for unsafe property traversal; ULS records 92liq. This security behavior is intentional. A farm administrator should bypass it only after confirming the property is safe. KB5030804 distinguishes SimplePropertyEntry:

add-pssnapin *
$f=get-spfarm
$f.AddGenericAllowedListValue("WebPartSupportedSimplePropertyNames","<UnsafePropertyName>")
$f.update()
iisreset

For BoundPropertyEntry:

add-pssnapin *
$f=get-spfarm
$f.AddGenericAllowedListValue("WebPartSupportedBoundPropertyNames","<UnsafePropertyName>")
$f.update()
iisreset

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2016

KB5002494 addresses Word remote code execution and SharePoint Server elevation of privilege: CVE-2023-36762, CVE-2023-36764.

Language-dependent KB5002501 also addresses Word remote code execution: CVE-2023-36762.

The core package KB5002494 includes these SharePoint Server changes:

  • Enables AMSI integration by default for existing and new web applications. See AMSI configuration.

  • Changes AMSI handling so a request is not blocked merely because AMSI cannot inspect it successfully; a new Health Analyzer rule reports malfunctioning protection to farm administrators.

The following improvement requires both KB5002501 and KB5002494:

  • Adds a Health Analyzer rule that checks whether AMSI is enabled and, when enabled, whether protection works. If protection fails, its report notifies farm administrators and recommends corrective steps.

Komentáře