Microsoft Patch Tuesday, June 2019 Edition

An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation.

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user. To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Word software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file. The security update addresses the vulnerability by correcting how Microsoft Word handles files in memory.

Microsoft Windows AppX Deployment Service (AppXSVC) improperly handles hard links, creating an elevation of privilege vulnerability tracked as CVE-2019-1064 (CWE-59, link following). The flaw is triggered when a local attacker who is already able to log on to an affected system runs a specially crafted application. Successful exploitation allows the attacker to run processes in an elevated context, then install programs and view, change, or delete data, effectively taking control of the affected system. Affected products span Windows 10 versions 1607, 1703, 1709, 1803, 1809, and 1903, plus Windows Server 1709, 1803, 1903, 2016, and 2019. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-15) with known ransomware use, so it is being actively exploited in the wild.

Do: Apply Microsoft's security update for all affected Windows 10 and Windows Server builds per vendor instructions, as required by CISA's KEV catalog, and upgrade any systems on builds 1607-1903 that no longer receive updates to a supported Windows release. Because exploitation requires local logon, prioritize patching multi-user workstations, RDP-exposed servers, and systems at ransomware risk, and confirm remediation by checking that the OS build includes the AppXSVC hard-link fix.

CVE-2019-1069 is a local elevation-of-privilege flaw in the Microsoft Windows Task Scheduler Service, which fails to correctly validate certain file operations (improper link/path resolution, CWE-59) that the service performs on behalf of running tasks. An attacker who has already gained unprivileged code execution on a target machine can trigger the vulnerable file operation so it is carried out by the Task Scheduler service with its elevated rights. Successful exploitation yields elevated privileges on the victim system, with CVSS impact rated High for confidentiality, integrity and availability, effectively giving the attacker full control of the local host. Affected products are Windows 10 versions 1507 through 1903 and Windows Server 1803, 1903, 2016 and 2019 — i.e., the Task Scheduler component in all of these builds. The flaw is exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-15 with known ransomware use, a public proof-of-concept has existed since June 2019, and EPSS estimates a ~6.1% probability of exploitation within 30 days (93rd percentile).

Do: Apply Microsoft's security updates for CVE-2019-1069 (released in the June 2019 Patch Tuesday cumulative updates) or later cumulative updates on Windows 10 1507–1903 and Windows Server 1803/1903/2016/2019, per CISA's required action. Verify installed OS builds against the affected list and prioritize shared/multi-user hosts (RDS/VDI, jump servers, workstations of users who run untrusted software), since ransomware operators chain this local privilege escalation after initial access. Where patching is delayed, restrict unprivileged code execution and monitor for suspicious scheduled-task and file-operation activity by the Task Scheduler service.