Patch Tuesday fixes four Microsoft zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-3298 | Information Disclosure in Microsoft Internet Explorer Messaging API CVE-2016-3298 is an information disclosure flaw (CWE-200) in the Microsoft Internet Messaging API used by Internet Explorer, in which the API improperly handles objects in memory. Exploitation requires driving Internet Explorer to process attacker-influenced content so the Messaging API mishandles memory, after which the attacker can probe whether specific files exist on the victim's disk. An attacker gains only limited reconnaissance value — confirming file presence for fingerprinting — rather than code execution or direct data theft. Only systems running Microsoft Internet Explorer, as cataloged by CISA, are affected; CISA added the bug to the Known Exploited Vulnerabilities catalog on 2022-05-24, confirming exploitation in the wild, though any ransomware association is unknown. EPSS estimates a 32.8% probability of exploitation within 30 days (98th percentile), no public proof-of-concept is known, and a CVSS score has not yet been published in this dataset. Do: Apply Microsoft's security update for CVE-2016-3298 per vendor instructions, as mandated by the CISA KEV catalog (added 2022-05-24, so remediation deadlines apply to federal agencies and many regulated environments). Audit any Windows hosts where Internet Explorer is still used for interactive browsing and confirm the patch is installed; because the flaw only permits probing for file existence, residual risk after patching is low. | 6.5 | 33% | KEV |
| masshundreds of millions of Windows devices (Internet Explorer shipped as a built-in Windows component for decades) | |
| CVE-2016-3393 | Remote Code Execution in Microsoft Windows GDI/GDI+ Graphics Component CVE-2016-3393 is a remote code execution vulnerability in the Windows Graphics Device Interface (GDI/GDI+), the component that renders text, images and graphics across Windows. An attacker triggers it by getting a user to visit a crafted website or otherwise view attacker-supplied content that is rendered through GDI (the CVSS vector confirms user interaction is required), and successful exploitation yields arbitrary code execution in the context of the current user. Affected software spans essentially the entire Windows estate of the era: Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 1507/1511/1607, and Windows Server 2008 SP2 and R2 SP1 and Server 2012 and 2012 R2. The flaw was patched in Microsoft's November 2016 Patch Tuesday, which fixed five zero-days being exploited in the wild, and reporting at the time attributed exploitation of this Windows graphics zero-day to the FruityArmor APT in targeted attacks. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-05-25), has a high EPSS score (68.7%, 99th percentile), and no public proof-of-concept is known. Do: Apply the November 2016 Microsoft security updates for the Windows Graphics Component to every affected Windows client and server version, per vendor instructions and CISA KEV's required action. For versions past end of support (Vista, 7, 8.1, RT 8.1, Server 2008/2012), move to a supported Windows release or apply Extended Security Updates. Until patched, discourage users from visiting untrusted websites or opening untrusted documents/images, and prioritize remediation on internet-facing servers and endpoints used by high-value users, given the documented targeted-attack use by the FruityArmor APT. | 7.8 | 69% | KEV |
| mass~hundreds of millions of Windows PCs and servers at the time of disclosure (affected versions spanned nearly the entire Windows installed base); today the… | |
| CVE-2016-7189 | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Remote Code Execu The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Remote Code Execution Vulnerability." NVD description · AI analysis pending | 7.5 | 48% |
| — | ||
| CVE-2016-7193 | Memory Corruption RCE in Microsoft Word and Office Components via Crafted RTF Files Microsoft Word and several related Office components contain a memory corruption flaw (CWE-119) in their handling of Rich Text Format (RTF) documents. An attacker triggers it by persuading a user to open a specially crafted RTF file, typically delivered as an email attachment, which corrupts memory and permits arbitrary code execution in the context of the current user (CVSS 3.1: 7.8, with user interaction required). The affected footprint is unusually broad, spanning Word 2007 SP2 through Word 2016 on Windows, Word for Mac 2011 and 2016, Word Viewer, the Office Compatibility Pack, Word Automation Services in SharePoint 2010/2013, and Office Web Apps/Office Online Server. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03) and carries an EPSS of 57.7 percent (99th percentile), indicating active in-the-wild exploitation; Microsoft addressed it in its November 2016 security updates. Do: Apply Microsoft's security updates for every affected component per vendor instructions, which is the required action in CISA's KEV catalog. Because exploitation occurs via malicious RTF files, consider blocking or sandboxing RTF email attachments and opening them in a protected/isolated mode until patches are deployed. Audit for legacy and easily overlooked components, including Word Viewer, the Office Compatibility Pack, Office Web Apps 2010/2013, SharePoint Word Automation Services, and Office Online Server, and upgrade or decommission any that remain unpatched. | 7.8 | 58% | KEV |
| masshundreds of millions of Office/Word installations worldwide (order of magnitude 10^8) |
Full article665 words · extracted from securityaffairs.com · click to collapse
Microsoft October security bulletins patch tens of vulnerabilities, including four Microsoft zero-day vulnerabilities that have been exploited in the wild.
Microsoft has released its monthly Patch Tuesday update that includes a total of 10 security bulletins, five the flaws addressed by the updates are zero-day vulnerabilities affecting Internet Explorer, Edge, Windows and Office products.
They could be exploited by a remote attacker to execute commands on the victim’s system. Security patches for the Microsoft zero-day vulnerabilities are included in MS16-118, MS16-119, MS16-120, MS16-121 and MS16-126.
The Microsoft zero-day have been reported by security experts from Google, Kaspersky, Proofpoint and Austria’s military CERT (MilCERT), there is no information about the motivation behind the attacks that exploited the flaws.
Below the list of Microsoft Zero-Day Vulnerabilities fixed by Microsoft in the October Patch Tuesday update.
- CVE-2016-3298 is a browser information disclosure vulnerability in the Internet Explorer. It is listed in the MS16-118 bulletin that 11 vulnerabilities. An attacker could exploit this flaw to “test for the presence of files on disk.” “An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk. For an attack to be successful an attacker must persuade a user to open a malicious website.” reported Microsoft.
- CVE-2016-7189: is a remote code execution vulnerability that affects the browser’s scripting engine and is included in the MS16-119 bulletin. It could allow attackers to gain the same user rights as the current use. “The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than users with administrative user rights.” reported Microsoft.
- CVE-2016-3393: is a remote code execution vulnerability in Microsoft Windows Graphics Component that has been addressed in MS16-120. Attacker could exploit is via the web, or by sending to the victims an email containing malicious file or over a file-sharing app. “A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.” reported Microsoft.
- CVE-2016-7193: Is a Microsoft Office Memory Corruption Vulnerability that has been addressed in MS16-121 bulletin. The flaw is a remote code execution vulnerability that affects the way Office handles RTF files. “An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.” reported Microsoft.”Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerabilities. An attacker would have no way to force users to visit the website.”
[adrotate banner=”9″]
(Security Affairs – Microsoft zero-day flaws, hacking)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/52186/hacking/microsoft-zero-da.html