Patch Tuesday, August 2018 Edition
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-8345 | A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "LNK Remote Code Execu A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "LNK Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8346. NVD description · AI analysis pending | 7.5 | 14% |
| — | ||
| CVE-2018-8373 | Memory Corruption RCE in Microsoft Internet Explorer Scripting Engine CVE-2018-8373 is an out-of-bounds write (CWE-787) in the Microsoft scripting engine's handling of objects in memory, which can corrupt memory and enable remote code execution in Internet Explorer 9, 10, and 11. It is triggered when a user is lured to an attacker-crafted web page or script in IE, with no privileges required but user interaction and relatively high attack complexity per the CVSS vector (AV:N/AC:H/UI:R). A successful attacker gains arbitrary code execution in the context of the current user, compromising that workstation's data and credentials. Any Windows system whose users browse with Internet Explorer 9, 10, or 11 was affected, and Microsoft fixed the flaw in its August 2018 Patch Tuesday release. The flaw was exploited as a zero-day in the wild at the time of patching — press coverage describes an in-the-wild VBScript zero-day blocked by endpoint protection — and it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-25; EPSS places the 30-day exploitation probability at 61.9% (99th percentile). Do: Apply Microsoft's August 2018 security updates for Internet Explorer on all supported Windows versions — the required action listed in the CISA KEV — and verify patch deployment via WSUS/SCCM/Intune across end-user workstations and RDS/browsing hosts. As interim mitigation, consider Microsoft's documented workaround of disabling VBScript execution in IE via feature-control keys and steer users away from IE for web browsing. Finally, migrate any remaining IE9/10/11 usage to Microsoft Edge (using IE mode for legacy sites), since IE11 is retired and this flaw is confirmed exploited in the wild. | 7.5 | 62% | KEV |
| masshundreds of millions of Windows devices (IE9–11 shipped with Windows; IE11 present by default on Windows 7/8.1/10) | |
| CVE-2018-8414 | File Path Validation RCE in Microsoft Windows Shell (Windows 10 and Server 1703–1803) Microsoft's Windows Shell improperly validates file paths in certain Windows 10 and Windows Server releases, a remote code execution flaw rooted in improper input validation (CWE-20). The flaw is triggered when the shell processes a specially crafted file path, typically requiring the victim to interact with a malicious file, as reflected in the CVSS user-interaction (UI:R) requirement. Successful exploitation lets an attacker execute arbitrary code in the context of the current user, with high impact on confidentiality, integrity, and availability. Affected products are Windows 10 versions 1703, 1709, and 1803 and Windows Server (Semi-Annual Channel) versions 1709 and 1803. The bug was patched in Microsoft's August 2018 Patch Tuesday after being reported as one of two zero-days actively exploited in attacks in the wild, was later added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-25, and EPSS currently estimates a 74% probability of exploitation within 30 days. Do: Apply Microsoft's August 2018 security updates or later cumulative updates for Windows 10 1703/1709/1803 and Windows Server 1709/1803, consistent with Microsoft guidance and CISA's KEV required action; because these builds are now legacy, upgrading to a currently supported Windows release is the durable fix. Until patched, treat untrusted files and shortcuts with caution since exploitation requires user interaction. Inventory endpoints for the affected builds to confirm they are fully remediated. | 8.8 | 74% | KEV |
| mass≈ hundreds of millions of Windows 10 devices at the time of disclosure (builds 1703–1803 were then-current Windows 10 releases); today only residual legacy,… |
Full article684 words · extracted from krebsonsecurity.com · click to collapse
Adobe and Microsoft each released security updates for their software on Tuesday. Adobe plugged five security holes in its Flash Player browser plugin. Microsoft pushed 17 updates to fix at least 60 vulnerabilities in Windows and other software, including two “zero-day” flaws that attackers were already exploiting before Microsoft issued patches to fix them.
According to security firm Ivanti, the first of the two zero-day flaws (CVE-2018-8373) is a critical flaw in Internet Explorer that attackers could use to foist malware on IE users who browse to hacked or booby-trapped sites. The other zero-day is a bug (CVE-2018-8414) in the Windows 10 shell that could allow an attacker to run code of his choice.
Microsoft also patched more variants of the Meltdown/Spectre memory vulnerabilities, collectively dubbed “Foreshadow” by a team of researchers who discovered and reported the Intel-based flaws. For more information about how Foreshadow works, check out their academic paper (PDF), and/or the video below. Microsoft’s analysis is here.
One nifty little bug fixed in this patch batch is CVE-2018-8345. It addresses a problem in the way Windows handles shortcut files; ending in the “.lnk” extension, shortcut files are Windows components that link (hence the “lnk” extension) easy-to-recognize icons to specific executable programs, and are typically placed on the user’s Desktop or Start Menu.
That description of a shortcut file was taken verbatim from the first widely read report on what would later be dubbed the Stuxnet worm, which also employed an exploit for a weakness in the way Windows handled shortcut (.lnk) files. According to security firm Qualys, this patch should be prioritized for both workstations and servers, as the user does not need to click the file to exploit. “Simply viewing a malicious LNK file can execute code as the logged-in user,” Qualys’ Jimmy Graham wrote.
Not infrequently, Redmond ships updates that end up causing stability issues for some users, and it doesn’t hurt to wait a day or two before seeing if any major problems are reported with new updates before installing them. Microsoft doesn’t make it easy for Windows 10 users to change this setting, but it is possible. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in Windows Update.
It’s a good idea to get in the habit of backing up your computer before applying monthly updates from Microsoft. Windows has some built-in tools that can help recover from bad patches, but restoring the system to a backup image taken just before installing updates is often much less hassle and an added peace of mind while you’re sitting there praying for the machine to reboot successfully after patching.
Adobe’s Flash update brings the program to v. 30.0.0.154 for Windows, macOS, Chrome and Linux. Most readers here know how I feel about Flash, which is a major security liability and a frequent target of browser-based attacks. The updates from Microsoft include these Flash fixes for IE, and Google Chrome has already pushed an update to address these five Flash flaws (although a browser restart may be needed).
But seriously, if you don’t have a specific need for Flash, just disable it already. Chrome is set to ask before playing Flash objects, but disabling Flash in Chrome is simple enough. Paste “chrome://settings/content” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist and blacklist specific sites.
By default, Mozilla Firefox on Windows computers with Flash installed runs Flash in a “protected mode,” which prompts the user to decide if they want to enable the plugin before Flash content runs on a Web site.
Adobe also released security updates for its PDF Reader and Acrobat products.
As always, please leave a note in the comments below if you experience any problems installing any of these updates.
Text extracted automatically; images, tables and formatting may be missing. Original: https://krebsonsecurity.com/2018/08/patch-tuesday-august-2018-edition/