Patch Tuesday, December 2018 Edition
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-8611 | Local Privilege Escalation in Microsoft Windows Kernel Exploited in the Wild CVE-2018-8611 is an elevation-of-privilege vulnerability in the Microsoft Windows kernel caused by improper handling of objects in memory (recorded as CWE-404, improper resource shutdown/release). It is a local flaw: an attacker who can already run code with limited privileges on a target machine can trigger it with a specially crafted application, with no user interaction required. Successful exploitation executes code in kernel context, elevating the attacker to SYSTEM/administrator and giving full control of the host, a typical post-initial-access step in ransomware chains. Nearly every Windows client and server version in support at disclosure is affected: Windows 7, 8.1, RT 8.1 and Windows 10 (1607 through 1809), plus Windows Server 2008 through 2019. The flaw is confirmed exploited in the wild, with CISA adding it to the KEV catalog on 2022-05-24 and an EPSS of 4.2% (90th percentile); the KEV record lists ransomware use as unknown, though public reporting ties a family of Windows kernel EoP exploits including this one to ransomware operators. Do: Apply Microsoft's December 2018 security update for CVE-2018-8611 on all affected Windows 7, 8.1, RT 8.1, 10 and Server 2008-2019 hosts; there is no known workaround and patching is the required CISA KEV action, so verify the December 2018 (or later) monthly rollup is installed. Prioritize servers and workstations where limited-privilege users or untrusted workloads run (RDS, application servers, shared endpoints), and treat any remaining unpatched Windows 7/8.1/legacy-Server machine as high risk because ransomware operators have been observed chaining Windows kernel EoP exploits like this one after initial access. | 7.8 | 4% | KEV |
| masshundreds of millions of Windows endpoints at time of disclosure (~700M active Windows 10 devices plus hundreds of millions of Windows 7 PCs), with residual… | |
| CVE-2018-8624 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engi A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8617, CVE-2018-8618, CVE-2018-8629. NVD description · AI analysis pending | 7.5 | 13% |
| — | ||
| CVE-2018-8628 | A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka "Microsoft Power A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka "Microsoft PowerPoint Remote Code Execution Vulnerability." This affects Microsoft Office, Office 365 ProPlus, Microsoft PowerPoint, Microsoft SharePoint, Microsoft PowerPoint Viewer, Office Online Server, Microsoft SharePoint Server. NVD description · AI analysis pending | 7.8 | 16% |
| — | ||
| CVE-2018-8631 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabilit A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. NVD description · AI analysis pending | 7.5 | 68% | PoC |
| — |
Full article581 words · extracted from krebsonsecurity.com · click to collapse
Adobe and Microsoft each released updates today to tackle critical security weaknesses in their software. Microsoft’s December patch batch is relatively light, addressing more than three dozen vulnerabilities in Windows and related applications. Adobe has issued security fixes for its Acrobat and PDF Reader products, and has a patch for yet another zero-day flaw in Flash Player that is already being exploited in the wild.
At least nine of the bugs in the Microsoft patches address flaws the company deems “critical,” meaning they can be exploited by malware or ne’er-do-wells to install malicious software with little or no help from users, save for perhaps browsing to a hacked or booby-trapped site.
Microsoft patched a zero-day flaw that is already being exploited (CVE-2018-8611) and allows an attacker to elevate his privileges on a host system. The weakness, which is present on all supported versions of Windows, is tagged with the less severe “important” rating by Microsoft mainly because it requires an attacker to be logged on to the system first.
According to security firm Rapid7, other notable vulnerabilities this month are in Internet Explorer (CVE-2018-8631) and Edge (CVE-2018-8624), both of which Microsoft considers most likely to be exploited. Similarly, CVE-2018-8628 is flaw in all supported versions of PowerPoint which is also likely to be used by attackers.
It generally can’t hurt for Windows users to wait a day or two after Microsoft releases monthly security updates before installing the fixes; occasionally buggy patches can cause serious headaches for users who install them before all the kinks are worked out. Also, it’s a good idea to get in the habit of backing up your data before installing Windows updates.
Windows 10 likes to install patches all in one go and reboot your computer on its own schedule. Microsoft doesn’t make it easy for Windows 10 users to change this setting, but it is possible. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in Windows Update.
For its part, Adobe’s got new versions of Adobe Reader and Adobe Acrobat that plug dozens of security holes in the programs. Also, last week Adobe issued an emergency patch to fix a zero-day flaw in Flash Player that bad guys are now using in active attacks.
Fortunately, the most popular Web browser by a long shot — Google Chrome — auto-updates Flash but also is now making users explicitly enable Flash every time they want to use it (Microsoft also bundles Flash with IE/Edge and updates it whenever Windows systems install monthly updates). By the summer of 2019 Google will make Chrome users go into their settings to enable it every time they want to run it.
Firefox also forces users with the Flash add-on installed to click in order to play Flash content; instructions for disabling or removing Flash from Firefox are here. Adobe will stop supporting Flash at the end of 2020.
As always, if you experience any problems installing any of these patches this month, please feel free to leave a comment about it below; there’s a good chance other readers have experienced the same and may even chime in here with some helpful tips.
Further reading:
Text extracted automatically; images, tables and formatting may be missing. Original: https://krebsonsecurity.com/2018/12/patch-tuesday-december-2018-edition/