Microsoft Issues Patch for Windows Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-8517 | A denial of service vulnerability exists when .NET Framework improperly handles special web requests, aka ".NET Framework Denial Of Service Vulnerability." This A denial of service vulnerability exists when .NET Framework improperly handles special web requests, aka ".NET Framework Denial Of Service Vulnerability." This affects Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 4.7.2. NVD description · AI analysis pending | 7.5 | 6% |
| — | ||
| CVE-2018-8611 | Local Privilege Escalation in Microsoft Windows Kernel Exploited in the Wild CVE-2018-8611 is an elevation-of-privilege vulnerability in the Microsoft Windows kernel caused by improper handling of objects in memory (recorded as CWE-404, improper resource shutdown/release). It is a local flaw: an attacker who can already run code with limited privileges on a target machine can trigger it with a specially crafted application, with no user interaction required. Successful exploitation executes code in kernel context, elevating the attacker to SYSTEM/administrator and giving full control of the host, a typical post-initial-access step in ransomware chains. Nearly every Windows client and server version in support at disclosure is affected: Windows 7, 8.1, RT 8.1 and Windows 10 (1607 through 1809), plus Windows Server 2008 through 2019. The flaw is confirmed exploited in the wild, with CISA adding it to the KEV catalog on 2022-05-24 and an EPSS of 4.2% (90th percentile); the KEV record lists ransomware use as unknown, though public reporting ties a family of Windows kernel EoP exploits including this one to ransomware operators. Do: Apply Microsoft's December 2018 security update for CVE-2018-8611 on all affected Windows 7, 8.1, RT 8.1, 10 and Server 2008-2019 hosts; there is no known workaround and patching is the required CISA KEV action, so verify the December 2018 (or later) monthly rollup is installed. Prioritize servers and workstations where limited-privilege users or untrusted workloads run (RDS, application servers, shared endpoints), and treat any remaining unpatched Windows 7/8.1/legacy-Server machine as high risk because ransomware operators have been observed chaining Windows kernel EoP exploits like this one after initial access. | 7.8 | 4% | KEV |
| masshundreds of millions of Windows endpoints at time of disclosure (~700M active Windows 10 devices plus hundreds of millions of Windows 7 PCs), with residual… |
Full article492 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalDec 12, 2018
Microsoft today, on its year-end December Patch Tuesday, released security updates to patch a total 39 vulnerabilities its Windows operating systems and applications—10 of which are rated as critical and other important in severity.
One of the security vulnerabilities patched by the tech giant this month is listed as publicly known at the time of release, and one is a zero-day reported as being actively exploited in the wild by multiple hacking groups, including FruityArmor and SandCat APTs.
Discovered and reported by security researchers at Kaspersky, the zero-day attack exploits an elevation-of-privilege (EoP) bug in the Windows Kernel (ntoskrnl.exe) that could allow malicious programs to execute arbitrary code with higher privileges on the targeted systems.
The vulnerability, tracked as CVE-2018-8611 and classified important in severity, resides in the Kernel Transaction Manager, which occurs due to improper processing of transacted file operations in kernel mode.
The flaw affects almost all versions of Windows operating system—Windows 7 through Server 2019.
"This vulnerability successfully bypasses modern process mitigation policies, such as Win32k System call Filtering that is used, among others, in the Microsoft Edge Sandbox and the Win32k Lockdown Policy employed in the Google Chrome Sandbox," Kaspersky said.
"Combined with a compromised renderer process, for example, this vulnerability can lead to a full Remote Command Execution exploit chain in the latest state-of-the-art web-browsers."
This is the third zero-day vulnerability Microsoft has back-to-back patched in three consecutive months through its regular monthly patch update to address a Win32K elevation of privilege bug.
Another important bug is a publicly known vulnerability, tracked as CVE-2018-8517, which is a denial-of-service issue in web applications built with the .NET Framework that exists due to improper handling of special web requests.
"The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Framework application," Microsoft explains.
The flaw was publicly disclosed, but Microsoft found no evidence of active exploitation of this vulnerability.
In addition to the zero-day and publicly known vulnerabilities, Microsoft patched 10 critical and 29 important vulnerabilities impacting a range of its products, including Windows, Edge, Internet Explorer, ChackraCore, Office and Microsoft Office Services and Web Apps, and the .NET Framework.
Besides its own products, Microsoft's December 2018 Patch Tuesday also includes a security update for a recently-disclosed zero-day flaw in Adobe Flash Player, which was also actively being exploited by a state-sponsored cyber-espionage group.
Users and system administrators are strongly recommended to apply the latest security patches as soon as possible to keep hackers and cybercriminals away from taking control of their systems.
For installing the latest security patch updates, head on to Settings → Update & Security → Windows Update → Check for updates, on your computer system or you can install the updates manually.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2018/12/microsoft-patch-updates.html