Patch Tuesday, October 2018 Edition
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-8423 | A remote code execution vulnerability exists in the Microsoft JET Database Engine, aka "Microsoft JET Database Engine Remote Code Execution Vulnerability." This A remote code execution vulnerability exists in the Microsoft JET Database Engine, aka "Microsoft JET Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. NVD description · AI analysis pending | 7.8 | 32% | PoC ×2 |
| — | |
| CVE-2018-8453 | Win32k Elevation of Privilege Flaw in Windows 7-10 and Windows Server (CVE-2018-8453) CVE-2018-8453 is an elevation of privilege vulnerability in the Windows Win32k kernel component, which fails to properly handle objects in memory, including the Win32k user-callback path reachable via NtUserSetWindowFNID. An attacker who can already execute code on an affected machine can trigger the flaw to escalate privileges, gaining the equivalent of SYSTEM-level rights with high impact on confidentiality, integrity, and availability. All broadly deployed Windows releases of the era are affected, spanning Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 1809), and Windows Server 2008 through 2019, so any unpatched Windows desktop or server is in scope. The flaw was exploited as a zero-day by the FruityArmor APT in targeted attacks in the Middle East, disclosed and patched in Microsoft's October 2018 Patch Tuesday, and has public proof-of-concept code. It is confirmed exploited in the wild: it sits in CISA's Known Exploited Vulnerabilities catalog (added 2022-01-21) with known ransomware use, and EPSS assigns a 70% probability of exploitation within 30 days. Do: Apply Microsoft's October 2018 (or later) cumulative security updates to all affected Windows 7/8.1/RT 8.1/Windows 10 clients and Windows Server 2008-2019 systems, per the vendor instructions required by CISA's KEV catalog. Prioritize multi-user hosts such as terminal/RDS servers and workstations where users can run untrusted code, since the attack requires local code execution with user interaction. Systems still on Windows 7/8.1 or Server 2008/2008 R2/2012 should be moved to Extended Security Updates or upgraded, and defenders should hunt for signs of FruityArmor-style activity on long-lived unpatched hosts. | 7.8 | 70% | KEV ransomware PoC ×2 |
| masshundreds of millions to ~1 billion+ Windows installations (Windows 10 alone ran on roughly 700 million active devices in 2018) |
Full article396 words · extracted from krebsonsecurity.com · click to collapse
Microsoft this week released software updates to fix roughly 50 security problems with various versions of its Windows operating system and related software, including one flaw that is already being exploited and another for which exploit code is publicly available.
The zero-day bug — CVE-2018-8453 — affects Windows versions 7, 8.1, 10 and Server 2008, 2012, 2016 and 2019. According to security firm Ivanti, an attacker first needs to log into the operating system, but then can exploit this vulnerability to gain administrator privileges.
Another vulnerability patched on Tuesday — CVE-2018-8423 — was publicly disclosed last month along with sample exploit code. This flaw involves a component shipped on all Windows machines and used by a number of programs, and could be exploited by getting a user to open a specially-crafted file — such as a booby-trapped Microsoft Office document.
KrebsOnSecurity has frequently suggested that Windows users wait a day or two after Microsoft releases monthly security updates before installing the fixes, with the rationale that occasionally buggy patches can cause serious headaches for users who install them before all the kinks are worked out.
This month, Microsoft briefly paused updates for Windows 10 users after many users reported losing all of the files in their “My Documents” folder. The worst part? Rolling back to previous saved versions of Windows prior to the update did not restore the files.
Microsoft appears to have since fixed the issue, but these kinds of incidents illustrate the value of not only waiting a day or two to install updates but also manually backing up your data prior to installing patches (i.e., not just simply counting on Microsoft’s System Restore feature to save the day should things go haywire).
Mercifully, Adobe has spared us an update this month for its Flash Player software, although it has shipped a non-security update for Flash.
For more on this month’s Patch Tuesday batch, check out posts from Ivanti and Qualys.
As always, if you experience any issues installing any of these patches this month, please feel free to leave a comment about it below; there’s a good chance other readers have experienced the same and may even chime in here with some helpful tips. My apologies for the tardiness of this post; I have been traveling in Australia this past week with only sporadic access to the Internet.
Downtown Melbourne, Australia.
Text extracted automatically; images, tables and formatting may be missing. Original: https://krebsonsecurity.com/2018/10/patch-tuesday-october-2018-edition/