Windows 7 Update appears to be compromised?

It's not the first time someone [or probably these days some computer] in charge of the approve button approved something it wasn't supposed to approve.  Hang tight, I'm not giving up on getting official word.

This is good to know, it sounds like for some reason, Microsoft just let an update through that our computers shouldn't need. It is a language update (some sort of Cyrillic) and in my case, it did not install on any of the computers. I hid the update, and once I rechecked it did not show back up. 

JG

I think Microsoft needs to check this one out... Too many people are downloading this, and Microsoft has NOT said that it is a legitimate update. I have had it download on three computers (one at a very large institution running Windows 7 Enterprise... The fonts appear to be Cyrillic fonts, but I am not absolutely certain.

JG

The link isn't a FQDN:

bleh://⁠rr1winwusfs04/⁠c/⁠msdownload/⁠update/⁠software/⁠defu/⁠2015/⁠09/⁠testexe_896e3a62-⁠8954-⁠447b-⁠5a562bd65cc6_d5e430cb05ee8a627ee6d811da8d7c4ccea57f4b.exe

This looks more like an admin made a boo boo and exposed an internal testing server...notice the path and "testexe"..I doubt this is malicious.

Actually the way patches are digitally signed, and it has to match up with a Microsoft cert authority while one never says anything is impossible, one can't inject something into the update without first compromising the entire OS's cert checking process.  And in this case, an attacker would be REALLY stupid to go through all that trouble to compromise the cert checking process and then blow it on the actual attack sequence.

"Simply injecting content into the update description" isn't simple at all.  It feels more like a Microsoft patch oopsie than anything nefarious.  Bottom line the update mechanism isn't easily compromised, typically requires physical access or some sort of physical injection of the cert attack (as I recall Flame malware injected itself with compromised USB devices).  It's one of the reasons that Microsoft can do peer to peer updating in Windows 10 and can assure that the bits coming to us from anywhere are still official Microsoft bits.

My point was if something is listed in the update history as failed you can't "hide" that one item, the update database doesn't work that way.

My gut tells me someone oopsie'd on Microsoft's side and I'm doing my best to confirm.