Cisco Talospublished Dec 10, 18:41 UTC (Dec 10, 2019)ingested Sep 10, 06:19 UTC

Microsoft Patch Tuesday — Dec. 2019: Vulnerability disclosures and Snort coverage

Tagscve-2019-1468 cve-2019-1471 cve-2019-1458 cve-2019-1469 cve-2019-1485 vulnerability

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2019-1332	A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web request A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web request to an affected SSRS server, aka 'Microsoft SQL Server Reporting Services XSS Vulnerability'. NVD description · AI analysis pending	6.1	9%	PoC	microsoft power bi report server microsoft sql server 2017 reporting services microsoft sql server 2019 reporting services	—	Dec 10, 2019
CVE-2019-1462 +3 in the same advisory: …1461 …1400 …1463	A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka 'Microsoft Power A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka 'Microsoft PowerPoint Remote Code Execution Vulnerability'. NVD description · AI analysis pending	7.8 group max	18%		microsoft office microsoft office 365 proplus microsoft powerpoint	—	Dec 10, 2019
CVE-2019-1468 +13 in the same advisory: …1471 …1484 …1476 …1483 …1477 …1453 +7	A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote Code A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote Code Execution Vulnerability'. NVD description · AI analysis pending	8.8 group max	17%		microsoft windows 10 microsoft windows 7 microsoft windows 8.1 +1 more	—	Dec 10, 2019
CVE-2019-1458	Win32k Object-Handling Flaw Enables Local Privilege Escalation in Microsoft Windows An elevation of privilege vulnerability exists in the Windows kernel's Win32k component, which fails to properly handle objects in memory (an uninitialized-variable condition). A local attacker who can already execute limited code on a target machine can trigger the flaw to gain kernel-level execution and elevate to SYSTEM privileges, giving full control of the host. Affected platforms are Windows 7, Windows 8.1, Windows RT 8.1, Windows 10 1507 and 1607, and Windows Server 2008, 2012 and 2016. The bug was patched in Microsoft's December 2019 Patch Tuesday after being actively exploited as a zero-day, including in the WizardOpium campaign attributed to a North Korea-linked actor. It is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-01-10, with known ransomware use) and carries a high EPSS of 74.3%. Do: Apply the December 2019 security updates (or later cumulative updates) from Microsoft per CISA's required action. Because Windows 7/8.1 and Server 2008/2012 are past end of support and Server 2016 support is winding down, prioritize migration to supported Windows versions. Hunt for signs of local privilege escalation and follow-on activity, since this bug was used as a zero-day and appears in ransomware attack chains.	7.8	74%	KEV ransomware PoC ×2	microsoft windows 10 1507 all supported editions at time of patch (December 2019) microsoft windows 10 1607 all supported editions at time of patch (December 2019) microsoft windows 7 all supported editions +5 more	masshundreds of millions of devices (Windows 7 alone held roughly a third of desktop market share at disclosure; millions of Server 2008/2012/2016 hosts remain…	Dec 10, 2019
CVE-2019-1464	An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'. NVD description · AI analysis pending	5.5	8%		microsoft excel microsoft office microsoft office 365 proplus	—	Dec 10, 2019
CVE-2019-1478 +2 in the same advisory: …1481 …1480	An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of Privilege Vulnerability An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of Privilege Vulnerability'. NVD description · AI analysis pending	7.8 group max	<1%		microsoft windows 7 microsoft windows server 2008	—	Dec 10, 2019
CVE-2019-1485	A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. NVD description · AI analysis pending	7.5	8%		microsoft internet explorer	—	Dec 10, 2019

Full article557 words · extracted from blog.talosintelligence.com · click to collapse

Tuesday, December 10, 2019 13:41

By Jon Munshaw.

Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates. This month's Patch Tuesday covers 25 vulnerabilities, two of which are considered critical.

This month’s security update covers security issues in a variety of Microsoft services and software, including Remote Desktop Protocol, Hyper-V and multiple Microsoft Office products.

Talos also released a new set of SNORTⓇ rules that provide coverage for some of these vulnerabilities. For more, check out the Snort blog post here.

Critical vulnerabilities Microsoft disclosed two critical vulnerabilities this month, both of which we will highlight below.

CVE-2019-1468 is a remote code execution vulnerability in the Windows font library that exists due to the library improperly handling some embedded fonts. An attacker could exploit this bug by using a specially crafted, malicious embedded font on a web page, and then trick the user into visiting that web page. Alternatively, a user would need to open a specially crafted font file on their machine.

CVE-2019-1471 is a remote code execution vulnerability in the Hyper-V hypervisor. Hyper-V can sometimes fail to properly validate input from an authenticated user on a guest operating system. An attacker could exploit this vulnerability by running a specially crafted application on a guest OS, which would cause the Hyper-V host OS to execute arbitrary code on the host operating system.

Important vulnerabilities This release also contains 23 important vulnerabilities, three of which we will highlight below.

CVE-2019-1458 is an elevation of privilege vulnerability in Windows' Win32k component. An attacker could exploit this vulnerability by logging onto a system, then running a specially crafted application that would allow them to take complete control of the system and execute arbitrary code in kernel mode. Microsoft reports that this vulnerability has been used in the wild.

CVE-2019-1469 is an information disclosure vulnerability in Windows that arises when the win32k component fails to provide kernel information. An attacker could exploit this vulnerability to obtain uninitialized memory and kernel memory, which could then be used in additional attacks.

CVE-2019-1485 is a remote code execution vulnerability in the VBscript engine. An attacker could exploit this vulnerability to corrupt memory of the affected system in a way that would allow them to execute arbitrary code in the context of the current user. To trigger this vulnerability, a user would have to visit a malicious, specially crafted website in the Internet Explorer web browser. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that utilizes Internet Explorer's rendering engine, and then trick the user into opening that file.

The other important vulnerabilities are:

Coverage In response to these vulnerability disclosures, Talos is releasing a new SNORTⓇ rule set that detects attempts to exploit some of them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open Source Snort Subscriber Rule Set customers can stay up-to-date by downloading the latest rule pack available for purchase on Snort.org.

These rules are: 52402, 52403, 52410, 52411, 52419, 52420

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/microsoft-patch-tuesday-dec-2019/