KB5033373 is a cumulative update for Windows Server 2016 and Windows Server 2016 Server Core installation. The update was released on 12 December as part of the ‘Patch Tuesday’ project of Microsoft.
KB5033373 has now been superseded by KB5034119 in January 2024. You may read about it on this page.
KB5033373 for Windows 10 version 1607 can be found here.
Salient points
- KB5033373 is a cumulative update that supersedes the KB5032197 cumulative update.
- KB5032197 was released on 14 November 2023 and you can read more about it on this KB5032197 page.
- KB5033373 corresponds to server build 14393.6529.
- KB5032197 corresponds to server build 14393.6452. If you had installed KB5032197, you would be transitioning from build 6452 to 6529.
- KB5032391 is the Servicing Stack Update that needs to be installed before installing KB5033373. KB5032391 is a Servicing Stack update for Windows Server 2016 released on 14 November 2023. There has been no SSU release for Windows Server 2016 in December 2023. If you already installed KB5032391 last month, you can skip the SSU installation and go straight to KB5033373 deployment.
- 17 security vulnerabilities have been reported for Windows Server 2016 in the December 2023 security bulletin released by Microsoft.
- 3 of these security vulnerabilities have a CRITICAL severity level for Windows Server 2016.
- 1 Zero-day threat affects Windows Server 2016. CVE-2023-20588 is the zero-day threat impacting the AMD Speculative Leaks. The threat could lead to ‘Loss of confidentiality’. Detailed security notices for the AMD vulnerability can be read on this page.
Details of security vulnerabilities on Windows Server 2016 are listed in the vulnerabilities section below.
Download KB5033373
KB5033373 can be applied automatically using one of the following methods:
- Windows Update
- Windows Update for Business
- WSUS or Windows Server Update Services
WSUS remains the most preferred method to automatically deploy security and cumulative updates.
For automated deployments, the Servicing Stack Update KB5032391 will be automatically installed before KB5032197 or KB5033373 are installed on Windows Server 2016.
For manual deployment of KB5033373, you will need to follow a 2-step process.
- Download and install KB5032391 Servicing Stack Update. You may have already installed it and can check the Windows Update history on your server. Remember that KB5032391 was released in November 2023. There has been no new SSU or Servicing Stack release in December 2023 for Windows Server 2016.
- Download and install the KB5033373 cumulative update.
The download for the Servicing Stack Update and the cumulative update can be completed from the Microsoft Update Catalog site. The installer is available as an offline installer file in the .MSU format.
Download KB5032391
The size of the Servicing Stack Update file is 11.6 MB. The server will not restart after installing the SSU.
Download KB5033373
KB5033373 for Windows Server 2016 can be downloaded from the Microsoft Update Catalog site. Or, you could use the direct download link below.
The size of the cumulative update KB5033373 is 1639.9 MB. KB5033373 will cause a server reboot. Please plan for implementation as part of an organized change management process.
Vulnerabilities
17 security vulnerabilities affect Windows Server 2016 as part of the December 2023 security reports. 3 of these vulnerabilities are CRITICAL severity vulnerabilities. There is a single zero-day threat that affects Windows Server 2016.
The remaining 14 security vulnerabilities have IMPORTANT severity levels.
We have listed the CRITICAL vulnerabilities and the zero-day threat for Windows Server 2016 below.
Zero-day vulnerability
The zero-day vulnerabilities are publicly known and exploited vulnerabilities. Therefore, immediate patching needs to be carried out to mitigate the risk arising out of zero-day vulnerabilities within the IT infrastructure.
The following zero-day threat was first reported in August 2023. It has been mitigated in the current Windows Update cycle. Therefore, we suggest immediate deployment of the cumulative update KB5033373.
| CVE details | CVSS | Severity | Impact | Description |
|---|---|---|---|---|
| CVE-2023-20588 | 5.5 | IMPORTANT | Loss of confidentiality | A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. |
CRITICAL Vulnerabilities
There are 3 CRITICAL security vulnerabilities affecting Windows Server 2016 and Windows Server 2016 Server Core installation. All these CRITICAL vulnerabilities could lead to a ‘Remote Code Execution’ impact on the server.
The three CRITICAL security vulnerabilities on Windows Server 2016 are listed below.
| CVE details | CVSS | Severity | Impact | Description |
|---|---|---|---|---|
| CVE-2023-35630 | 8.8 | CRITICAL | Remote Code Execution | This threat impacts the Internet Connection Sharing (ICS). Successful exploitation of this vulnerability requires the attacker to modify an option->length field in a DHCPv6 DHCPV6_MESSAGE_INFORMATION_REQUEST input message. This attack is limited to systems connected to the same network segment as the attacker. |
| CVE-2023-35628 | 8.1 | CRITICAL | Remote Code Execution | This vulnerability arises on account of Windows MSHTML Platform. The attacker could exploit this vulnerability by sending a specially crafted email which triggers automatically when it is retrieved and processed by the Outlook client. This could lead to exploitation BEFORE the email is viewed in the Preview Pane. This could result in the attacker executing remote code on the victim’s machine. |
| CVE-2023-35641 | 8.8 | CRITICAL | Remote Code Execution | This threat affects the Internet Connection Sharing (ICS). To exploit this vulnerability, an attacker would need to send a maliciously crafted DHCP message to a server that runs the Internet Connection Sharing service. This attack is limited to systems connected to the same network segment as the attacker |
KB5033373 Changelog
The following changes or improvements are part of the KB5033373 cumulative update for Windows Server 2016:
- This update affects the Netherlands time zone. It adds the recent man-made landmass outside of Rotterdam to the shape files.
- This update addresses security issues for your Windows operating system.
December 2023 Cumulative or Security Updates
- KB5033371 for Windows 10 version 1809
- KB5033373 for Windows 10 version 1607
- KB5033379 for Windows 10
- KB5033372 for Windows 10 21H2 and 22H2
- KB5033375 Cumulative Update for Windows 11 22H2 and 23H2
- KB5033369 Cumulative Update for Windows 11 21H2
- KB5033420 Monthly Rollup Update for Windows Server 2012 R2
- KB5033429 Monthly Rollup Update for Windows Server 2012
- KB5033383 Cumulative Update for Windows Server 2022
- KB5033118 Cumulative Update for Windows Server 2022
- KB5033371 Cumulative Update for Windows Server 2019
- KB5033373 Cumulative Update for Windows Server 2016
- Microsoft Edge upgrades to version 120.0.2210.61
November 2023 Cumulative or Security Updates
Rajesh Dhawan is a technology professional who loves to write about Cyber-security events and stories, Cloud computing and Microsoft technologies. He loves to break complex problems into manageable chunks of meaningful information.