Microsoft Patch Tuesday updates for March 2019 patches two Windows flaws exploited in targeted attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0808 +1 in the same advisory: …0797 | Local Privilege Escalation in Microsoft Win32k on Windows 7 and Server 2008 CVE-2019-0808 is an elevation-of-privilege flaw in the Windows Win32k kernel component, which fails to properly handle objects in memory, allowing a local, low-privileged attacker to execute code in the kernel and take full control of the system (CVSS 3.1: 7.8, high impact on confidentiality, integrity and availability). It is triggered by a local attacker running crafted actions against vulnerable Win32k system calls; a public proof of concept based on the NtUserMNDragOver call path is available. Per the source data, affected products are Windows 7 and Windows Server 2008 (exact service-pack/version ranges are not specified in the data). The bug was one of two Win32k zero-days patched in the March 2019 Patch Tuesday, was being actively exploited in targeted attacks attributed to the FruityArmor and SandCat groups, and Microsoft followed with an out-of-band fix after Google disclosed the zero-day. It is listed in CISA KEV (added 2021-11-03, ransomware use unknown), and EPSS currently assigns roughly a 53% probability of exploitation within 30 days (99th percentile). Do: Apply the March 2019 Microsoft security updates (or the out-of-band fix) for Windows 7 and Windows Server 2008, including Extended Security Updates for systems past the January 2020 end of support, per the CISA KEV required action. Prioritize shared/terminal and RDS hosts where low-privileged users log in, since successful exploitation grants kernel-level privileges, and review those systems for indicators of the FruityArmor/SandCat targeted intrusions. No reliable workaround is documented for this Win32k flaw, so patching is the primary mitigation. | 7.8 | 53% | KEV PoC |
| massroughly 500 million+ Windows 7 / Windows Server 2008 installations (Windows 7 held ~40% desktop OS share in early 2019) | |
| CVE-2019-5786 | Actively Exploited Use-After-Free in Google Chrome Blink CVE-2019-5786 is a use-after-free (object lifetime) flaw in Blink, the rendering engine of Google Chrome, fixed in Chrome 72.0.3626.121. A remote attacker triggers it by luring a user to a crafted HTML page, where the stale object allows an out-of-bounds memory access within the renderer process. Successful exploitation produces memory corruption in the browser renderer — scored in the CVSS vector primarily as high availability impact — and Google disclosed the flaw being actively exploited in targeted attacks, reportedly chained with a separate Windows zero-day that Microsoft patched out of band in March 2019. Anyone running Chrome older than 72.0.3626.121 was affected, which at disclosure time meant a large share of Chrome's billion-plus desktop user base. Exploitation is confirmed in the wild: the issue was a zero-day before the patch, it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-23, and EPSS assigns a ~61.5% probability of exploitation within 30 days (99th percentile). Do: Update Chrome to 72.0.3626.121 or later — verify via the browser's About/Settings help page and relaunch any pending auto-update, since Chrome self-updates but requires a relaunch. Treat as a KEV priority and patch per vendor instructions, and apply Microsoft's March 2019 updates, including the out-of-band Windows fix, because the Chrome flaw was used in combination with a Windows zero-day in the observed targeted attacks. | 6.5 | 62% | KEV PoC |
| mass≈1 billion+ Chrome users/installations at the time (all Chrome deployments on versions before 72.0.3626.121) |
Full article390 words · extracted from securityaffairs.com · click to collapse
Microsoft Patch Tuesday updates for March 2019 address 64 flaws, including two Windows zero-day vulnerabilities exploited in targeted attacks.
Microsoft Patch Tuesday updates for March 2019 address 64 vulnerabilities, including two Windows zero-day flaws that have been exploited in targeted attacks.
Four of the vulnerabilities addressed by Microsoft were publicly disclosed before fixes were released, they have been classified by Microsoft as “important.” 17 vulnerabilities impacting Windows and Microsoft’s Edge and Internet Explorer web browsers were rated as “critical”.
The first zero-day addressed by Microsoft is tracked as CVE-2019-0808. This flaw was recently disclosed by Google’s Threat Analysis Group after it has observed targeted attacks exploiting the issue alongside a recently addressed flaw in Chrome flaw (CVE-2019-5786).
The CVE-2019-0808 resides in the Win32k component, it could be exploited by an authenticated attacker to elevate privileges and execute arbitrary code in kernel mode.
Experts argue the Windows zero-day could be exploited only on Windows 7 due to recent exploit mitigations added in newer versions of Microsoft OS. To date, experts only observed active exploitation against Windows 7 32-bit systems.
Microsoft did not reveal technical details about the attacks that involved the Windows zero-day.
No information has been provided about the attacks involving this vulnerability.
The second zero-day addressed by Microsoft Patch Tuesday updates for March 2019 is a privilege escalation vulnerability tracked as CVE-2019-0797 that affects the Win32k component.
The issue could be exploited by an authenticated attacker to run a specially crafted application that could exploit the vulnerability and take control of an affected system.
“An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.” reads the security advisory.
“An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”
The CVE-2019-0797 affects Windows 10, Windows 8.1, Windows Server 2012, Windows Server 2016, and Windows Server 2019. According to Microsoft, the vulnerability is hard to exploit against the latest versions of Windows.
This Windows zero-day was discovered by Kaspersky Lab and experts believe that at least two threat groups exploited it in targeted attacks.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Microsoft Patch Tuesday updates for March 2019, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/82321/security/microsoft-patch-tuesday-march-09.html