Patch Tuesday Lowdown, October 2019 Edition
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-1367 | Memory Corruption RCE in Microsoft Internet Explorer Scripting Engine CVE-2019-1367 is a memory corruption flaw (CWE-787, out-of-bounds write) in the way the Internet Explorer scripting engine handles objects in memory, enabling remote code execution when the corrupted objects are processed. Attackers trigger it by convincing a user to load malicious web content in an affected Internet Explorer installation — such as visiting an attacker-controlled or compromised page, or opening a document/application that hosts IE — with user interaction required per the CVSS vector. Successful exploitation executes attacker code with the user's privileges; the flaw was exploited as an actively-attacked zero-day, with distribution observed through the Magnitude exploit kit, prompting Microsoft to release an out-of-band emergency fix. Any Windows system with an affected Internet Explorer installation is exposed, with enterprise users dependent on IE for legacy web applications at particular risk. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, with known ransomware use), EPSS estimates a 52.4% probability of exploitation within 30 days, and no public proof-of-concept is catalogued. Do: Apply Microsoft's out-of-band (September 2019) and subsequent cumulative Windows/Internet Explorer security updates on all endpoints, per the vendor's instructions, since this is a KEV-listed flaw with known ransomware use; Microsoft's documented mitigation, restricting access to the IE scripting engine component (jscript.dll) and reducing use of Internet Explorer in favor of a modern browser, can protect systems until patched. Verify the update applied cleanly — users reportedly experienced problems with the initial patches — and prioritize user workstations and any systems used to browse untrusted content. | 7.5 | 52% | KEV ransomware |
| masstens of millions to hundreds of millions of Windows endpoints with Internet Explorer present (IE is bundled with Windows) |
Full article528 words · extracted from krebsonsecurity.com · click to collapse
On Tuesday Microsoft issued software updates to fix almost five dozen security problems in Windows and software designed to run on top of it. By most accounts, it’s a relatively light patch batch this month. Here’s a look at the highlights.
Happily, only about 15 percent of the bugs patched this week earned Microsoft’s most dire “critical” rating. Microsoft labels flaws critical when they could be exploited by miscreants or malware to seize control over a vulnerable system without any help from the user.
Also, Adobe has kindly granted us another month’s respite from patching security holes in its Flash Player browser plugin.
Included in this month’s roundup is something Microsoft actually first started shipping in the third week of September, when it released an emergency update to fix a critical Internet Explorer zero-day flaw (CVE-2019-1367) that was being exploited in the wild.
That out-of-band security update for IE caused printer errors for many Microsoft users whose computers applied the emergency update early on, according to Windows update expert Woody Leonhard. Apparently, the fix available through this month’s roundup addresses those issues.
Security firm Ivanti notes that the patch for the IE zero day flaw was released prior to today for Windows 10 through cumulative updates, but that an IE rollup for any pre-Windows 10 systems needs to be manually downloaded and installed.
Once again, Microsoft is fixing dangerous bugs in its Remote Desktop Client, the Windows feature that lets a user interact with a remote desktop as if they were sitting in front of the other PC. On the bright side, this critical bug can only be exploited by tricking a user into connecting to a malicious Remote Desktop server — not exactly the most likely attack scenario.
Other notable vulnerabilities addressed this month include a pair of critical security holes in Microsoft Excel versions 2010-2019 for Mac and Windows, as well as Office 365. These flaws would allow an attacker to install malware just by getting a user to open a booby-trapped Office file.
Windows 10 likes to install patches all in one go and reboot your computer on its own schedule. Microsoft doesn’t make it easy for Windows 10 users to change this setting, but it is possible. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in Windows Update. To get there, click the Windows key on your keyboard and type “windows update” into the box that pops up.
Staying up-to-date on Windows patches is good. Updating only after you’ve backed up your important data and files is even better. A reliable backup means you’re not pulling your hair out if the odd buggy patch causes problems booting the system. So do yourself a favor and backup your files before installing any patches.
As always, if you experience any problems installing any of the patches this month, please feel free to leave a comment about it below; there’s a decent chance other readers have experienced the same and may even chime in here with some helpful tips.
Text extracted automatically; images, tables and formatting may be missing. Original: https://krebsonsecurity.com/2019/10/patch-tuesday-lowdown-october-2019-edition/