March 2019 Patch Tuesday: Microsoft patches two actively exploited Windows flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0603 | A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory. A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. To exploit the vulnerability, an attacker could create a specially crafted request, causing Windows to execute arbitrary code with elevated permissions. The security update addresses the vulnerability by correcting how Windows Deployment Services TFTP Server handles objects in memory, aka 'Windows Deployment Services TFTP Server Remote Code Execution Vulnerability'. NVD description · AI analysis pending | 7.5 | 34% |
| — | ||
| CVE-2019-0698 | A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Clien A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0697, CVE-2019-0726. NVD description · AI analysis pending | 9.8 | 63% |
| — | ||
| CVE-2019-0809 +1 in the same advisory: …0757 | A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading dynamic link library A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading dynamic link library (DLL) files, aka 'Visual Studio Remote Code Execution Vulnerability'. NVD description · AI analysis pending | 7.8 group max | 11% |
| — | ||
| CVE-2019-0808 +1 in the same advisory: …0797 | Local Privilege Escalation in Microsoft Win32k on Windows 7 and Server 2008 CVE-2019-0808 is an elevation-of-privilege flaw in the Windows Win32k kernel component, which fails to properly handle objects in memory, allowing a local, low-privileged attacker to execute code in the kernel and take full control of the system (CVSS 3.1: 7.8, high impact on confidentiality, integrity and availability). It is triggered by a local attacker running crafted actions against vulnerable Win32k system calls; a public proof of concept based on the NtUserMNDragOver call path is available. Per the source data, affected products are Windows 7 and Windows Server 2008 (exact service-pack/version ranges are not specified in the data). The bug was one of two Win32k zero-days patched in the March 2019 Patch Tuesday, was being actively exploited in targeted attacks attributed to the FruityArmor and SandCat groups, and Microsoft followed with an out-of-band fix after Google disclosed the zero-day. It is listed in CISA KEV (added 2021-11-03, ransomware use unknown), and EPSS currently assigns roughly a 53% probability of exploitation within 30 days (99th percentile). Do: Apply the March 2019 Microsoft security updates (or the out-of-band fix) for Windows 7 and Windows Server 2008, including Extended Security Updates for systems past the January 2020 end of support, per the CISA KEV required action. Prioritize shared/terminal and RDS hosts where low-privileged users log in, since successful exploitation grants kernel-level privileges, and review those systems for indicators of the FruityArmor/SandCat targeted intrusions. No reliable workaround is documented for this Win32k flaw, so patching is the primary mitigation. | 7.8 | 53% | KEV PoC |
| massroughly 500 million+ Windows 7 / Windows Server 2008 installations (Windows 7 held ~40% desktop OS share in early 2019) |
Full article532 words · extracted from helpnetsecurity.com · click to collapse
As part of the March 2019 Patch Tuesday, Microsoft has released fixes for 64 CVE-numbered vulnerabilities, 17 of which are rated Critical and 45 Important.
Interestingly enough, none of the two vulnerabilities that are being actively exploited in the wild and of the four listed as being publicly known are rated Critical.
Vulnerabilities exploited in the wild
CVE-2019-0808 and CVE-2019-0797 are both Win32k Elevation of Privilege vulnerabilities under active attack.
The first one was flagged by Clément Lecigne of Google’s Threat Analysis Group and was spotted being exploited in conjunction with a Chrome zero-day use-after-free vulnerability that allowed attackers to escape the Chrome sandbox and perform remote code execution on the underlying operating system.
CVE-2019-0808 was found not to affect Windows 10 – patches have been provided for Windows 7 and Windows Server 2008.
The second one was reported by Kaspersky Labs and it is being used in targeted attacks.
Other vulnerabilities of note
CVE-2019-0603 is an RCE flaw in Windows Deployment Services (WDS) that’s similar to the one recently revealed by Check Point.
“This bug is in the implementation of the TFTP service and not in the TFTP protocol itself,” noted Dustin Childs, director of communications for Trend Micro’s Zero Day Initiative.
“To exploit this bug, an attacker would need to send a specially crafted request to an affected server. If you’re using WDS in your environment, definitely put this one near the top of your test and deployment list.”
Three critical RCE flaws (CVE-2019-0697, CVE-2019-0698, CVE-2019-0726) in the Windows DHCP have also been fixed and the patches should be prioritized for Windows systems as a DHCP client is present on all versions of the OS and exploitation can be performed with no user interaction.
“There would likely need to be a man-in-the-middle component to properly execute an attack, but a successful exploit would have wide-ranging consequences,” Childs pointed out.
Greg Wiseman, senior security researcher for Rapid7, singled out the vulnerabilities of particular interest to developers:
- CVE-2019-0809 (Visual Studio Remote Code Execution Vulnerability, affecting the Visual Studio C++ Redistributable Installer) and
- CVE-2019-0757 (a NuGet Package Manager Tampering Vulnerability, which affects installations on Linux and Mac).
The advisories
Microsoft has also released four advisories:
- ADV990001: Includes the latest servicing stack updates for each operating sytem
- ADV190008: Includes minor security fixes for Adobe Flash Player
- ADV190010: Provides Best Practices Regarding Sharing of a Single User Account Across Multiple Users
- ADV190009: Announces the release of SHA-2 code sign support for Windows 7 SP1, and Windows Server 2008 R2 SP1.
“Without the patches published under the ADV190009 advisory, systems will no longer be able to receive security updates later this year,” Wiseman pointed out.
“Microsoft currently signs their product updates using both the SHA-1 and SHA-2 hash algorithms. Over the last several years, cryptography researchers have found various weaknesses in SHA-1 that make it easier to find ‘collisions’ – opening up the potential for someone to craft a different, potentially malicious update file that looks legitimate to Windows Update. To safeguard against this, Microsoft will start using SHA-2 exclusively after July 2019.”
UPDATE (March 14, 2019, 5:51 a.m. PT):
Qihoo 360 Core researchers have released more details about CVE-2019-0808, as well as PoC exploit code.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/03/13/march-2019-patch-tuesday/