Microsoft Releases Patches for 64 Flaws — Two Under Active Attack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0808 +1 in the same advisory: …0797 | Local Privilege Escalation in Microsoft Win32k on Windows 7 and Server 2008 CVE-2019-0808 is an elevation-of-privilege flaw in the Windows Win32k kernel component, which fails to properly handle objects in memory, allowing a local, low-privileged attacker to execute code in the kernel and take full control of the system (CVSS 3.1: 7.8, high impact on confidentiality, integrity and availability). It is triggered by a local attacker running crafted actions against vulnerable Win32k system calls; a public proof of concept based on the NtUserMNDragOver call path is available. Per the source data, affected products are Windows 7 and Windows Server 2008 (exact service-pack/version ranges are not specified in the data). The bug was one of two Win32k zero-days patched in the March 2019 Patch Tuesday, was being actively exploited in targeted attacks attributed to the FruityArmor and SandCat groups, and Microsoft followed with an out-of-band fix after Google disclosed the zero-day. It is listed in CISA KEV (added 2021-11-03, ransomware use unknown), and EPSS currently assigns roughly a 53% probability of exploitation within 30 days (99th percentile). Do: Apply the March 2019 Microsoft security updates (or the out-of-band fix) for Windows 7 and Windows Server 2008, including Extended Security Updates for systems past the January 2020 end of support, per the CISA KEV required action. Prioritize shared/terminal and RDS hosts where low-privileged users log in, since successful exploitation grants kernel-level privileges, and review those systems for indicators of the FruityArmor/SandCat targeted intrusions. No reliable workaround is documented for this Win32k flaw, so patching is the primary mitigation. | 7.8 | 53% | KEV PoC |
| massroughly 500 million+ Windows 7 / Windows Server 2008 installations (Windows 7 held ~40% desktop OS share in early 2019) | |
| CVE-2019-5786 | Actively Exploited Use-After-Free in Google Chrome Blink CVE-2019-5786 is a use-after-free (object lifetime) flaw in Blink, the rendering engine of Google Chrome, fixed in Chrome 72.0.3626.121. A remote attacker triggers it by luring a user to a crafted HTML page, where the stale object allows an out-of-bounds memory access within the renderer process. Successful exploitation produces memory corruption in the browser renderer — scored in the CVSS vector primarily as high availability impact — and Google disclosed the flaw being actively exploited in targeted attacks, reportedly chained with a separate Windows zero-day that Microsoft patched out of band in March 2019. Anyone running Chrome older than 72.0.3626.121 was affected, which at disclosure time meant a large share of Chrome's billion-plus desktop user base. Exploitation is confirmed in the wild: the issue was a zero-day before the patch, it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-23, and EPSS assigns a ~61.5% probability of exploitation within 30 days (99th percentile). Do: Update Chrome to 72.0.3626.121 or later — verify via the browser's About/Settings help page and relaunch any pending auto-update, since Chrome self-updates but requires a relaunch. Treat as a KEV priority and patch per vendor instructions, and apply Microsoft's March 2019 updates, including the out-of-band Windows fix, because the Chrome flaw was used in combination with a Windows zero-day in the observed targeted attacks. | 6.5 | 62% | KEV PoC |
| mass≈1 billion+ Chrome users/installations at the time (all Chrome deployments on versions before 72.0.3626.121) |
Full article656 words · extracted from thehackernews.com · click to collapse
The Hacker NewsMar 12, 2019
It's time for another batch of "Patch Tuesday" updates from Microsoft.
Microsoft today released its March 2019 software updates to address a total of 64 CVE-listed security vulnerabilities in its Windows operating systems and other products, 17 of which are rated critical, 45 important, one moderate and one low in severity.
The update addresses flaws in Windows, Internet Explorer, Edge, MS Office, and MS Office SharePoint, ChakraCore, Skype for Business, and Visual Studio NuGet.
Four of the security vulnerabilities, all rated important, patched by the tech giant this month were disclosed publicly, of which none were found exploited in the wild.
Microsoft Patches Two Zero-Day Flaws Under Active Attack
Microsoft has also patched two separate zero-day elevation of privilege vulnerabilities in Windows.
Both flaws, also rated as important, reside in Win32k component that hackers are actively exploiting in the wild, including the one that Google warned of last week.
If you are unaware, Google last week released a critical update for Chrome web browser to address a high-severity flaw (CVE-2019-5786) that attackers found exploiting in combination with a Windows vulnerability (CVE-2019-0808).
Successful exploitation of both flaws together allowed remote attackers to execute arbitrary code on targeted computers running Windows 7 or Server 2008 and take full control of them.
The second zero-day elevation of privilege vulnerability in Windows, assigned as CVE-2019-0797, that's also being exploited in the wild is similar to the first one but affects Windows 10, 8.1, Server 2012, 2016, and 2019.
This flaw was detected and reported to Microsoft by security researchers Vasily Berdnikov and Boris Larin of Kaspersky Labs, who in a blog post today revealed that the flaw has actively been exploited in targeted attacks by several threat actors including, FruityArmor and SandCat.
"CVE-2019-0797 is a race condition that is present in the win32k driver due to a lack of proper synchronization between undocumented syscalls NtDCompositionDiscardFrame and NtDCompositionDestroyConnection," the researchers say.
Update Also Patches 17 Critical and 45 Important Flaws
As expected, almost all of the listed critical-rated vulnerabilities lead to remote code execution attacks and primarily impact various versions of Windows 10 and Server editions. Most of these flaws reside in Chakra Scripting Engine, VBScript Engine, DHCP Client, and IE.
While some of the important-rated vulnerabilities also lead to remote code execution attacks, others allow elevation of privilege, information disclosure, and denial of service attacks.
Users and system administrators are strongly recommended to apply the latest security patches as soon as possible to keep hackers and cybercriminals away from taking control of their systems.
For installing the latest security patch updates, head on to Settings → Update & Security → Windows Update → Check for updates, on your computer system or you can install the updates manually.
Windows 10 Now Automatically Uninstalls Updates That Cause Problems
For addressing problematic update issues on Windows 10 devices, Microsoft on Monday introduced a safety measure that automatically uninstalls buggy software updates installed on your system if your operating system detects a startup failure.
So after installing this month’s security update, if you receive the following notification on your device, your Windows 10 computer has been recovered from a startup failure, and the operating system resolved the failure by uninstalling recently installed Windows updates.
"We removed some recently installed updates to recover your device from a startup failure."
Windows 10 will then automatically block installation of that problematic updates for the next 30 days, and will deliver the update again after investigating and fixing the issue.
Adobe also rolled out security updates today to fix just two critical arbitrary code execution vulnerabilities in Adobe Photoshop CC and another in Adobe Digital Editions. Users of the affected Adobe software for Windows and macOS are advised to update their software packages to the latest versions.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2019/03/microsoft-windows-security-updates.html