September 2018 Patch Tuesday: Microsoft fixes actively exploited zero-day
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-5391 | The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size. NVD description · AI analysis pending | 7.5 | 32% |
| — | ||
| CVE-2018-8440 | Local Privilege Escalation in Windows ALPC Handling (Win 7–10, Server 2008–2016) An elevation-of-privilege vulnerability exists in the way Windows handles calls to the Advanced Local Procedure Call (ALPC) facility, rated 7.8 High with a local attack vector and only low privileges required. An attacker who can already run code on a machine as a low-privileged user can send crafted ALPC messages that the OS mishandles, elevating their privileges to SYSTEM/administrator without any user interaction. Successful exploitation yields full local control (high impact on confidentiality, integrity and availability) and is typically used to consolidate a foothold or escape low-privilege contexts, including in ransomware chains. Affected systems are Windows 7, 8.1, RT 8.1, Windows 10 (1607, 1703, 1709, 1803), Windows 10 Servers, and Windows Server 2008 through 2016 — essentially every Windows client and server platform in support at disclosure. The flaw was publicly demonstrated via a published proof of concept in August 2018, fixed in Microsoft's September 2018 security updates, and is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-28 with known ransomware use, and EPSS puts 30-day exploitation probability at 18.4% (97th percentile). Do: Apply the September 2018 (or later) Microsoft cumulative/monthly rollup updates across all affected Windows client and server systems, prioritizing servers and domain-joined hosts given known ransomware use and the CISA KEV listing. Legacy machines that no longer receive updates (e.g., Windows 7, Server 2008/2008 R2, 2012/2012 R2) should be upgraded to a supported OS or covered by Extended Security Updates. Verify remediation by confirming the September 2018 patch level is present on each host, since OS version alone does not indicate exposure. | 7.8 | 18% | KEV ransomware PoC |
| mass≈1 billion+ Windows installations were in affected versions at the 2018 disclosure; the residual unpatched estate today is likely in the millions of legacy… | |
| CVE-2018-8475 +1 in the same advisory: …8449 | A remote code execution vulnerability exists when Windows does not properly handle specially crafted image files, aka "Windows Remote Code Execution Vulnerabili A remote code execution vulnerability exists when Windows does not properly handle specially crafted image files, aka "Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. NVD description · AI analysis pending | 8.8 group max | 16% |
| — |
Full article473 words · extracted from helpnetsecurity.com · click to collapse
Microsoft’s September 2018 Patch Tuesday has brought fixes for a little over 60 security vulnerabilities, 17 of which are critical and one is being actively exploited in the wild.
The software giant has also released two advisories: one detailing the vulnerabilities it plugged in Adobe Flash and the other announcing that the company is still working on an update for CVE-2018-5391, a Windows denial of service vulnerability against the IP stack dubbed “FragmentSmack”. (The advisory contains some workarounds).
Patches to prioritize
As mentioned before, one of the patched flaws is being exploited by attackers.
CVE-2018-8440, a local privilege escalation vulnerability that arises when Windows incorrectly handles calls to the Advanced Local Procedure Call (ALPC) interface, was revealed publicly in late August. The researcher who found it also published PoC exploit code for it, and it didn’t take long for attackers to take advantage of it, making this is one patch a priority for everyone.
Another patch that should be prioritized is that for CVE-2018-8475, a critical Windows remote code execution vulnerability that allows attackers to execute code simply by convincing the target to view an image with malicious code.
“Open the wrong image – even through a web browser – and code executes, making this a browse-and-own scenario,” Trend Micro Zero Day Initiative’s Dustin Childs pointed out. “Microsoft provides no information on where this is public, but given the severity of the issue and the relative ease of exploitation, expect this one to find its way into exploit kits quickly.”
CVE-2018-8449 is a security feature bypass that makes Device Guard incorrectly validate an unsigned file. “Because Device Guard relies on the signature to determine the file is non-malicious, Device Guard could then allow a malicious file to execute,” Microsoft noted. Needless to say, this one can come in handy to malware peddlers and other attackers.
Jimmy Graham, Director of Product Management at Qualys, says that the browser and Scripting Engine patches should be prioritized for workstation-type devices.
“The PDF viewer, Windows image parsing, .net Framework, and Windows font library also have patches available that require a user to interact with a malicious site or file. With two of these vulnerabilities being publicly disclosed, it is important to prioritize Windows workstation patching.”
Patches for Hyper-V systems should also be quickly implemented, as they bring fixes for two remote code execution vulnerabilities.
“For both cases, a user on a guest virtual machine could execute code on the underlying hypervisor OS,” Childs explained. “The root cause for both of these bugs goes back to the failure to properly validate user input. Although titled as ‘remote code execution,’ these bugs require an attacker to execute code on the guest OS. If an attacker (or malware) does have the ability to run programs, their code executes on the hypervisor – potentially impacting other guest OSes.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2018/09/12/september-2018-patch-tuesday/