October 2019 Patch Tuesday: A small batch of updates from Microsoft, none from Adobe
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-1315 | Elevation of Privilege in Microsoft Windows Error Reporting Manager via Hard Link Abuse Windows Error Reporting (WER) Manager improperly handles hard links (CWE-59, link following), allowing a local attacker with low privileges to redirect privileged file operations performed by the service. By planting a hard link that points at files WER operates on, the attacker can get the service to act on attacker-controlled content in a privileged context, with no user interaction required. Successful exploitation grants elevation of privilege on the local machine — commonly to SYSTEM — with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, AV:L/PR:L). Users of Windows 7, 8.1, and RT 8.1, Windows 10 builds 1607 through 1903, and Windows Server 2008, 2012, and 2016 are affected; this issue is distinct from the related CVE-2019-1339 and CVE-2019-1342. The flaw was fixed in Microsoft's October 2019 Patch Tuesday and was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-15 with known ransomware use, so it is being exploited in the wild even though no public proof-of-concept is known. Do: Apply Microsoft's October 2019 Patch Tuesday security updates on all affected Windows 7/8.1/10 clients and Windows Server 2008/2012/2016 hosts via Windows Update, WSUS, or SCCM, as required by the CISA KEV catalog. Because CISA reports ransomware operators exploiting this flaw, prioritize domain-joined and internet-reachable servers and verify patch compliance across the estate, focusing on hosts where non-admin users can log on locally. If patching must be delayed, restrict interactive logon rights to trusted low-privilege users, since exploitation requires local access. | 7.8 | 3% | KEV ransomware |
| mass≈1 billion Windows devices (affected versions spanned nearly the entire Windows installed base at the October 2019 fix) | |
| CVE-2019-1365 +1 in the same advisory: …1333 | An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it.An attacker who suc An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it.An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT AUTHORITY\system escaping the Sandbox.The security update addresses the vulnerability by correcting how Microsoft IIS Server sanitizes web requests., aka 'Microsoft IIS Server Elevation of Privilege Vulnerability'. NVD description · AI analysis pending | 9.9 group max | 4% |
| — | ||
| CVE-2019-1372 | An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length of a buffer prior to copying memory to it An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length of a buffer prior to copying memory to it.An attacker who successfully exploited this vulnerability could allow an unprivileged function run by the user to execute code in the context of NT AUTHORITY\system thereby escaping the Sandbox.The security update addresses the vulnerability by ensuring that Azure App Service sanitizes user inputs., aka 'Azure App Service Remote Code Execution Vulnerability'. NVD description · AI analysis pending | 10.0 | 19% |
| — |
Full article640 words · extracted from helpnetsecurity.com · click to collapse
As predicted by Ivanti’s Chris Goettl, October 2019 Patch Tuesday came with a relatively small number of Microsoft updates and, curiously enough, with no security updates from Adobe.
There is no report of any of the Microsoft bugs being exploited, but there is public PoC code for and info about a local privilege escalation flaw in Windows Error Reporting (CVE-2019-1315).
Microsoft’s patches
Microsoft has addressed nearly 60 vulnerabilities, nine of which are critical.
Seven of those affect browsers and scripting engines (Chakra, MS XML, VBScript) so, according to Jimmy Graham, Senior Director of Product Management at Qualys, they should be prioritized for any system that is used for email or to access the internet via a browser (i.e., workstations, multi-user servers that are used as remote desktops for users).
The other two are CVE-2019-1333, a remote code execution (RCE) flaw in the Windows Remote Desktop Client, and CVE-2019-1372, a RCE in Azure App Service.
To take advantage of the former, an attacker must trick users into connecting to a malicious or compromised RDP server controlled by them or intercept and re-route traffic to it. Also, since the flaw is client-side, it’s not wormable and, therefore, not as dangerous as the BlueKeep or DejaBlue bugs.
“Although listed as an RCE, you could look at [the Azure App Service RCE] as an Elevation of Privilege (EoP). These bugs rarely get listed as Critical severity, but this one certainly earns its rating,” says Trend Micro ZDI’s Dustin Childs.
“An attacker could use this vulnerability to have an unprivileged function run by a user execute code at the level of System. That provides an attacker a nifty sandbox escape. Microsoft gives this an ‘Exploitation Less Likely’ Exploit Index rating, but if you use the Azure App Service, don’t depend on that and do apply the patch.”
Childs also urges enterprises running Microsoft IIS servers to plug CVE-2019-1365 as soon as possible. “Similar to the previously mentioned Azure bug, an attacker could use this vulnerability to execute code as System and escape the sandbox. Given the importance of most IIS servers in an enterprise, definitely put this near the top of your test-and-deploy list,” he noted.
Finally, there’s the latest servicing stack updates (SSUs) for a variety of Windows and Windows Server editions, including Windows 7 and Windows Server 2008 R2, which will be out of extended support and no longer receiving updates as of January 14, 2020. These are also deemed to be critical – although that doesn’t mean that they contain any CVE fixes.
“The service stack is the Windows operating system component responsible for processing and deploying the OS and application patches/updates,” Goettl explained.
“SSUs should always be applied prior to all other updates to ensure a successful outcome. And while strongly recommended, but not specifically required, Microsoft states, ‘If you don’t install the latest servicing stack update, there’s a risk that your device can’t be updated with the latest Microsoft security fixes.'”
As a side note: it might be good for admins to implement the emergency Internet Explorer and Microsoft Defender fixes the company released on September 24 (if they haven’t already). The IE fix was initially available only as a manual update, then later via Windows Update.
Intel’s updates
This month’s Intel’s fixes are for:
- Two medium severity privilege escalation flaws in the Intel Active System Console for Intel Server Boards and Systems and Intel Smart Connect Technology for Intel NUC
- High severity EoP, DoS and information disclosure bugs in the system firmware for Intel NUC (affecting the Game Mini Computer and various versions of the NUC kit and board).
No updates from Adobe
As mentioned before, Adobe did not release any security updates on this Patch Tuesday. The latest ones were released on September 24, and were out-of-band updates for ColdFusion 2016 and 2018.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/10/09/october-2019-patch-tuesday/