Description of the security update for SharePoint Server 2016: December 12, 2017

Summary

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2017-11936.

Note To apply this security update, you must have the release version of SharePoint Server 2016 installed on the computer.This public update also delivers all the features previously included in Feature Pack 1 for SharePoint Server 2016, including:

• Administrative Actions Logging
• MinRole enhancements
• SharePoint Custom Tiles
• Hybrid Auditing (preview)
• Hybrid Taxonomy
• OneDrive API for SharePoint on-premises
• OneDrive for Business modern experience (available to Software Assurance customers)
  The OneDrive for Business modern user experience requires an active Software Assurance contract at the time that it is enabled, either by installation of the public update or by manual enablement. If you don’t have an active Software Assurance contract at the time of enablement, you must turn off the OneDrive for Business modern user experience.For more information, see New features included in the November 2016 Public Update for SharePoint Server 2016 (Feature Pack 1) and New features included in the September 2017 Public Update for SharePoint Server 2016 (Feature Pack 2).

Improvements and fixes

This security update contains improvements and fixes for the following nonsecurity issues:

• Assume that you have an enterprise resource that is a part of a team assignment pool. When you go to the Resource Center, select the resource and then click theCapacity Planning button, the resource is not displayed, and in some cases you see the error “Sorry, something went wrong.”
• When you set properties that are imported from Active Directory by using the user interface, certain unchecked containers other than organization unit (OU) scope are not respected.
• Consider the following scenario:
  • A project manager publishes a task to a team member.
  • The team member goes to their timesheet and enters actual work on the task.
  • The timesheet is submitted and then approved.
  • The project in which the task exists is deleted.
  • The team member goes back to their timesheet.
    In this situation, the task on which the actual work was submitted is no longer there.
• This update fixes an issue where the top report part of the Search Reports would count the same queries incorrectly with different casing. For example, “query”, “QUERY”, and “Query” were treated as unique query texts and counted accordingly. This fix lowercases the query text before calculating the counts.
• When you search Chinese-Simplified or Chinese-Traditional content in SharePoint 2016, you may not see the relevant results or the query keywords may not be highlighted in the results. This issue occurs because the search falls back to the English word breaker when the query is Chinese-Simplified or Chinese-Traditional based. This update resolves the issue so that the correct word breaker is selected.
• When you search for keywords that contain some specific Korean characters, the search fails because the token length is calculated incorrectly.
• When you delete a value from a custom field that’s configured to display a graphical indicator, the record in the database is not deleted, but instead the value is set to NULL, and the indicator value is preserved in reporting.
• This update reduces the default version limit number for the default document library on new SharePoint 2016 team sites from 500 down to 10. This will make storage capacity planning easier.
• This update changes the short names of the services that are using a built-in service account to friendly display names so that it’s easy to understand what service is described in the SharePoint health rules report.
• This update improves the Thai word breaker for complex compound words when you search in SharePoint.
• Translates some terms in multiple languages to make sure that the meaning is accurate.
• This update also has the following improvements:
  • Improves the SharePoint Health Analyzer algorithm that checks the free space on drives to handle large drives better. The algorithm will now report a warning if the free disk space is less than 10 GB or report an error if the free disk space is less than 4 GB.
  • Removes the following five health analyzer rules to reduce noise:
    • Health Analyzer: Validate the My Site Host and individual My Sites are on a dedicated Web application and separate URL domain
    • Health Analyzer: Database has large amounts of unused space
    • Health Analyzer: Alternate access URLs have not been configured
    • Health Analyzer: People search relevance is not optimized when the Active Directory has errors in the manager reporting structure
    • Health Analyzer: Search - One or more crawl databases may have fragmented indices

How to get and install the update

Method 1: Microsoft Update

This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the stand-alone package for this update, go to the Microsoft Update Catalog website.

Method 3: Microsoft Download Center

You can get the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

• Download the security update KB4011576 for the 64-bit version of SharePoint Server 2016

More Information

Security update deployment information

For deployment information about this update, see security update deployment information: December 12, 2017.

Security update replacement information

This security update replaces the previously released update, KB 4011244.

File hash information

Package Name	Package Hash SHA 1	Package Hash SHA 2
sts2016-kb4011576-fullfile-x64-glb.exe	1393A2F066A5CFC86A1F0B2998EFA316F8D98148	99700E2C70182DA73387B5BA64E4E097DC387579A572B4C6F1456F57766D9D8A

File information

For the list of files this security update KB 4011576 contains, download the file information for update 4011576.

How to get help and support for this security update

Help for installing updates: Windows Update FAQ

Security solutions for IT professionals: Security Support and Troubleshooting

Help for protecting your Windows-based computer from viruses and malware: Microsoft Secure

Local support according to your country: International SupportPropose a feature or provide feedback on SharePoint: SharePoint User Voice portal