Microsoft Patch Tuesday — February 2019 Update Fixes 77 Flaws

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0604.

Microsoft SharePoint fails to check the source markup of an application package, an improper input validation flaw (CWE-20) that allows maliciously crafted markup to be processed by the server. An attacker triggers the flaw by getting an affected SharePoint server to handle a crafted application package, without any special privileges described in the disclosure. Successful exploitation lets the attacker run remote code in the context of the SharePoint application pool and the SharePoint server farm account, providing control of the web server and access to a highly privileged farm-level identity. Any organization running an affected on-premises Microsoft SharePoint deployment is exposed, with internet-facing SharePoint servers at greatest risk. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and EPSS puts the probability of exploitation at 99.9%, although no public proof-of-concept is catalogued.

Do: Apply Microsoft's SharePoint security updates per vendor instructions immediately, prioritizing internet-exposed SharePoint servers as CISA's required action directs. Given known in-the-wild and ransomware use, hunt for signs of compromise such as unexpected .aspx or webshell files in SharePoint directories and anomalous use of the SharePoint farm account. Restrict or firewall internet exposure of SharePoint servers until patches are confirmed applied.

A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP server, aka 'Windows DHCP Server Remote Code Execution Vulnerability'.

CVE-2019-0676 is an information disclosure vulnerability in Microsoft Internet Explorer caused by improper handling of objects in memory. It is exploited remotely via attacker-crafted content, most likely a malicious web page or link, that the victim must open in Internet Explorer, as reflected by the user-interaction requirement in the CVSS vector. A successful attacker can probe the victim's system and test for the presence of specific files on disk, which is useful for reconnaissance and tailoring follow-on attacks; there is no integrity or availability impact. Affected systems are those running Microsoft Internet Explorer, per CISA and Microsoft data. The flaw is listed in the CISA KEV catalog (added 2022-05-23), confirming known exploitation in the wild, with an EPSS 30-day exploitation probability of 7.5% (94th percentile), and remediation is via Microsoft security updates.

Do: Apply Microsoft security updates for Internet Explorer/Windows per vendor instructions, as required by the CISA KEV listing, and verify patch status across internet-exposed and user workstations. Because exploitation requires user interaction, caution users against opening untrusted links in IE, and consider disabling or removing Internet Explorer where it is no longer needed. Monitor for KEV-driven remediation deadlines and check environments for evidence of the file-existence probing behavior.