Cisco Talospublished Mar 13, 21:38 UTC (Mar 13, 2018)ingested Sep 10, 06:19 UTCNick Biasini

Microsoft Patch Tuesday

criticalVulnerabilityimportance 60CVE-2018-0872 CVE-2018-0874 CVE-2018-0876 CVE-2018-0889 CVE-2018-0893 CVE-2018-0925 CVE-2018-0930 CVE-2018-0931 CVE-2018-0932 CVE-2018-0933 CVE-2018-0934 CVE-2018-0936 CVE-2018-0937 CVE-2018-0939 CVE-2018-0883 CVE-2018-0877 CVE-2018-0878 CVE-2018-0879 CVE-2018-0880 CVE-2018-0881 CVE-2018-0882 CVE-2018-0787 CVE-2018-0808 CVE-2018-0811 CVE-2018-0813 CVE-2018-0814 CVE-2018-0815 CVE-2018-0816 CVE-2018-0817 CVE-2018-0868 CVE-2018-0873 CVE-2018-0875 CVE-2018-0884 CVE-2018-0885 CVE-2018-0886 CVE-2018-0888 CVE-2018-0891 CVE-2018-0894 CVE-2018-0895 CVE-2018-0896 CVE-2018-0897 CVE-2018-0898 CVE-2018-0899 CVE-2018-0900 CVE-2018-0901 CVE-2018-0902 CVE-2018-0903 CVE-2018-0904 CVE-2018-0907 CVE-2018-0909 CVE-2018-0910 CVE-2018-0911 CVE-2018-0912 CVE-2018-0913 CVE-2018-0914 CVE-2018-0915 CVE-2018-0916 CVE-2018-0917 CVE-2018-0919 CVE-2018-0921 CVE-2018-0922 CVE-2018-0923 CVE-2018-0926 CVE-2018-0927 CVE-2018-0929 CVE-2018-0935 CVE-2018-0940 CVE-2018-0941 CVE-2018-0942 CVE-2018-0944 CVE-2018-0947 CVE-2018-0977 CVE-2018-0983

Read the original

Tagscve-2018-0872 cve-2018-0874 cve-2018-0876 cve-2018-0889 cve-2018-0893 vulnerability

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2018-0787 +2 in the same advisory: …0875 …0808	ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability". NVD description · AI analysis pending	8.8 group max	10%		microsoft asp.net core	—	Mar 14, 2018
CVE-2018-0877 +28 in the same advisory: …0886 …0884 …0902 …0883 …0880 …0882 +22	The Desktop Bridge Virtual File System (VFS) in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of pri The Desktop Bridge Virtual File System (VFS) in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to how file paths are managed, aka "Windows Desktop Bridge VFS Elevation of Privilege Vulnerability". NVD description · AI analysis pending	7.8 group max	3%	PoC	microsoft windows 10 microsoft windows server microsoft windows server 2016	—	Mar 14, 2018
CVE-2018-0815	The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Windows 7 SP1 allows an elevation of privilege vulnerability due The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Windows 7 SP1 allows an elevation of privilege vulnerability due to the way objects are handled in memory, aka "Windows GDI Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0816, and CVE-2018-0817. NVD description · AI analysis pending	7.0	1%		microsoft windows 7 microsoft windows server 2008	—	Mar 14, 2018
CVE-2018-0933 +13 in the same advisory: …0934 …0893 …0874 …0876 …0872 …0873 +7	ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine h ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0873, CVE-2018-0874, CVE-2018-0930, CVE-2018-0931, CVE-2018-0934, CVE-2018-0936, and CVE-2018-0937. NVD description · AI analysis pending	7.5 group max	66%	PoC	microsoft edge microsoft chakracore	—	Mar 14, 2018
CVE-2018-0935 +5 in the same advisory: …0889 …0891 …0929 …0927 …0942	Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0876, CVE-2018-0889, CVE-2018-0893, and CVE-2018-0925. NVD description · AI analysis pending	7.5 group max	56%	PoC	microsoft internet explorer	—	Mar 14, 2018
CVE-2018-0903	Microsoft Access 2010 SP2, Microsoft Access 2013 SP1, Microsoft Access 2016, and Microsoft Office 2016 Click-to-Run allow a remote code execution vulnerability Microsoft Access 2010 SP2, Microsoft Access 2013 SP1, Microsoft Access 2016, and Microsoft Office 2016 Click-to-Run allow a remote code execution vulnerability due to how objects are handled in memory, aka "Microsoft Access Remote Code Execution Vulnerability". NVD description · AI analysis pending	7.8	16%		microsoft access microsoft office	—	Mar 14, 2018
CVE-2018-0907	Microsoft Excel 2007 SP3, Microsoft Excel 2010 SP2, Microsoft Excel 2013 SP1, Microsoft Excel 2016, Microsoft Office 2016 Click-to-Run and Microsoft Office 2016 Microsoft Excel 2007 SP3, Microsoft Excel 2010 SP2, Microsoft Excel 2013 SP1, Microsoft Excel 2016, Microsoft Office 2016 Click-to-Run and Microsoft Office 2016 for Mac allow a security feature bypass vulnerability due to how macro settings are enforced, aka "Microsoft Office Excel Security Feature Bypass". NVD description · AI analysis pending	7.8	6%		microsoft excel microsoft office	—	Mar 14, 2018
CVE-2018-0909 +8 in the same advisory: …0910 …0911 …0912 …0913 …0914 …0915 +2	Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0910, CVE-2018-0911, CVE-2018-0912, CVE-2018-0913, CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0921, CVE-2018-0923, CVE-2018-0944 and CVE-2018-0947. NVD description · AI analysis pending	8.8	5%		microsoft project server microsoft sharepoint enterprise server	—	Mar 14, 2018
CVE-2018-0917 +3 in the same advisory: …0921 …0923 …0947	Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microso Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0912, CVE-2018-0913 CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0921, CVE-2018-0923, CVE-2018-0944 and CVE-2018-0947. NVD description · AI analysis pending	8.8	5%		microsoft sharepoint enterprise server	—	Mar 14, 2018
CVE-2018-0922 +1 in the same advisory: …0919	Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Compatibility Pack SP2, Micros Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Compatibility Pack SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps 2013 SP1, Microsoft Office Word Viewer, Microsoft SharePoint Enterprise Server 2013 SP1, Microsoft SharePoint Enterprise Server 2016, Microsoft Office Compatibility Pack SP2, Microsoft Online Server 2016, Microsoft SharePoint Server 2010 SP2, Microsoft Word 2007 SP3, Microsoft Word 2010 SP2, Word 2013 and Microsoft Word 2016 allow a remote code execution vulnerability due to how objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". NVD description · AI analysis pending	7.8 group max	18%		microsoft office microsoft office compatibility pack microsoft office online server +1 more	—	Mar 14, 2018
CVE-2018-0925	ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerabi ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0876, CVE-2018-0889, CVE-2018-0893, and CVE-2018-0935. NVD description · AI analysis pending	7.5	11%		microsoft chakracore	—	Mar 14, 2018
CVE-2018-0940 +1 in the same advisory: …0941	Microsoft Exchange Outlook Web Access (OWA) in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update Microsoft Exchange Outlook Web Access (OWA) in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server 2016 Cumulative Update 7, and Microsoft Exchange Server 2016 Cumulative Update 8 allows an elevation of privilege vulnerability due to how links in the body of an email message are rewritten, aka "Microsoft Exchange Elevation of Privilege Vulnerability". NVD description · AI analysis pending	6.5 group max	7%		microsoft exchange server	—	Mar 14, 2018

Full article812 words · extracted from blog.talosintelligence.com · click to collapse

Tuesday, March 13, 2018 17:38

Microsoft Patch Tuesday - March 2018 Today, Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 74 new vulnerabilities, with 14 of them rated critical and 59 of them rated important. These vulnerabilities impact Internet Explorer, Edge, Exchange, Scripting Engine, Windows Shell and more.

Critical Vulnerabilities This month, Microsoft is addressing 14 vulnerabilities that are rated as critical.

The vulnerabilities rated as critical are listed below:

Important Vulnerabilities This month, Microsoft is addressing 59 vulnerabilities that are rated as important. Talos believes one of these is notable and should be called out.

CVE-2018-0883 - Windows Shell Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Windows Shell. This vulnerability could be exploited by an attacker convincing a user to open a specially crafted file via email, messaging, or other means. An attacker exploiting this vulnerability could execute arbitrary code in context of the current user.

Other vulnerabilities rated as important are listed below:

Coverage In response to these vulnerability disclosures, Talos is releasing the following Snort rules that detect attempts to exploit them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

Snort Rules:
45873-45884
45887-45890
45892-45895
45900-45903

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/ms-tuesday-63063210e63ef5e7e1ec313d/