April 2019 Patch Tuesday: Microsoft fixes two actively exploited bugs
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0803 +1 in the same advisory: …0859 | Local Privilege Escalation in Microsoft Win32k Kernel Component CVE-2019-0803 is a privilege escalation flaw in Microsoft's Win32k kernel component caused by improper handling of objects in memory. It is triggered locally when code already running on a Windows system reaches the vulnerable Win32k object-handling path, allowing memory corruption that the attacker can leverage. Successful exploitation lets the attacker run arbitrary code in kernel mode, elevating from a low-privileged account to full system-level control. Per the available data, the affected component is Microsoft Win32k across Windows installations, though specific affected Windows versions and builds are not enumerated in the source data and should be confirmed against Microsoft's advisory. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns a 45.2% probability of exploitation within 30 days (99th percentile). Do: Apply Microsoft Windows security updates per vendor instructions — this flaw was fixed in Microsoft's April 2019 security updates, so ensure systems are running those or later cumulative updates and verify by checking OS build numbers. Prioritize patching endpoints and servers where untrusted or low-privileged users can execute code, given documented ransomware chaining. Treat KEV status as a deadline: systems unpatched for this Win32k flaw should be considered actively targeted. | 7.8 | 45% | KEV ransomware |
| masshundreds of millions of Windows desktops and servers (Win32k is a core component shipped with essentially all Windows installations) | |
| CVE-2019-0841 | Local Privilege Escalation via Hard-Link Flaw in Windows AppX Deployment Service CVE-2019-0841 is a local privilege escalation flaw in the Windows AppX Deployment Service (AppXSVC), which handles deployment of packaged (AppX) applications. The service improperly handles hard links (CWE-59), letting a local attacker manipulate hard links so that AppXSVC performs file operations in protected locations with elevated rights. A successful exploit allows the attacker to run processes in an elevated context — effectively administrative/SYSTEM privileges — which ransomware operators have used in chained attacks. Any unpatched Microsoft Windows system is potentially affected; the available data lists only 'Microsoft Windows' without specific version ranges, so defenders should consult Microsoft's advisory for exact affected releases. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-15 with known ransomware use, and EPSS assigns a 41.4% probability of exploitation within 30 days (99th percentile), although no public proof-of-concept is catalogued. Do: Apply Microsoft's Windows cumulative updates per vendor instructions as the KEV required action, prioritizing systems where users can log on locally, since exploitation requires local access; the fix shipped in Microsoft's April 2019 security release, so confirm no hosts remain on older builds. Because ransomware operators chain this local privilege escalation, verify patch status across the estate with your inventory tooling and monitor for unexpected elevation or hard-link manipulation on AppXSVC as interim risk reduction. | 7.8 | 41% | KEV ransomware PoC ×2 |
| masshundreds of millions of Windows endpoints potentially in scope (Windows runs on 1B+ active devices, ~70% desktop share), limited to unpatched systems | |
| CVE-2019-0853 | A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Ex A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'. NVD description · AI analysis pending | 8.8 group max | 29% |
| — | ||
| CVE-2019-7096 | Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability. Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution. NVD description · AI analysis pending | 9.8 | 6% |
| — |
Full article674 words · extracted from helpnetsecurity.com · click to collapse
Microsoft has plugged 74 CVE-numbered security holes on this April 2019 Patch Tuesday, including two vulnerabilities actively exploited by attackers. All of the bugs are rated either Critical or Important.
Adobe has also released security updates for many of its products, including the widely used Flash Player and Shockwave Player (the freeware software plug-in for viewing multimedia and video games in web pages).
The Adobe updates
Adobe has provided security updates for many software packages.
The Flash update contains fixes for a bug that could lead to information disclosure bug and a critical use-after-free vulnerability that could lead to arbitrary code execution in the context of the current user (CVE-2019-7096).
Critical flaws have also been killed off in the Bridge CC, InDesign, Adobe XD, Acrobat and Reader, and Shockwave Player.
None of the plugged holes are under active exploitation. Nevertheless, Qualys Senior Director of Product Management Jimmy Graham advises administrators to prioritize Adobe Flash and Acrobat/Reader patches for workstation-type systems.
The Microsoft updates
Microsoft has delivered a security update for Adobe Flash that mirrors that of Adobe.
Other updates are for a wide variety of software. Among the most notable vulnerabilities fixed are:
CVE-2019-0803 and CVE-2019-0859: Two Win32k vulnerabilities that could be exploited to elevate privileges on a targeted system and take it over.
Flagged by Kaspersky Labs and the Alibaba Cloud Intelligence Security Team, both of these are actively exploited in the wild and were zero-days when the attacks were detected by the researchers.
“There’s not much info on how these bugs are being used, but targeted malware seems the most likely source. Regardless, get these rolled out to your systems quickly,” says Dustin Childs, Director of Communications for Trend Micro’s Zero Day Initiative.
CVE-2019-0841: A privilege escalation vulnerability in the Windows AppX Deployment Service (AppXSVC), which is responsible for the deployment of Windows Store apps.
“The vulnerability involves the service’s handling of hard links. A PoC has been made available in the public domain. Patching should be prioritized for both Workstations and Servers, as this service exists on both Windows 10 and Server 2019,” Graham advises.
CVE-2019-0853: A remote code execution flaw in the Windows Graphics Device Interface (GDI).
“There are multiple ways an attacker could exploit the vulnerability,” Microsoft explained.
“In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability and then convince users to view the website. In a file-sharing attack scenario, an attacker could provide a specially crafted document file that is designed to exploit the vulnerability, and then convince users to open the document file.”
CVE-2019-0845: A remote code execution flaw in the IOleCvt interface (The Automation interface for the IOleCvt object enables an ASP Web page to perform a variety of string conversions from one format to another).
“In a web-based attack scenario, an attacker could host a specially crafted website designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked ‘safe for initialization’ in an application or Microsoft Office document that hosts the browser rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability,” the company noted.
CVE-2019-0856: A remote code execution flaw that arose due to Windows’ improper handling of objects in memory. It was flagged by the Australian Cyber Security Centre (Australian Signals Directorate).
“To exploit the vulnerability, an authenticated attacker could connect via the Windows Remote Registry Service, causing Windows to execute arbitrary code,” Microsoft shared.
“This patch write-up is definitely an oddity. The title lists this as Remote Code Execution, but the description indicates an attacker would need to log on to a system to exploit the bug. Either way, considering it affects all supported Windows versions and that it was fixed by ‘correcting how Windows handles objects in memory,’ – this patch should definitely not be missed,” Childs opined.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/04/10/april-2019-patch-tuesday/