Microsoft Releases April 2019 Security Updates — Two Flaws Under Active Attack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0803 +1 in the same advisory: …0859 | Local Privilege Escalation in Microsoft Win32k Kernel Component CVE-2019-0803 is a privilege escalation flaw in Microsoft's Win32k kernel component caused by improper handling of objects in memory. It is triggered locally when code already running on a Windows system reaches the vulnerable Win32k object-handling path, allowing memory corruption that the attacker can leverage. Successful exploitation lets the attacker run arbitrary code in kernel mode, elevating from a low-privileged account to full system-level control. Per the available data, the affected component is Microsoft Win32k across Windows installations, though specific affected Windows versions and builds are not enumerated in the source data and should be confirmed against Microsoft's advisory. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns a 45.2% probability of exploitation within 30 days (99th percentile). Do: Apply Microsoft Windows security updates per vendor instructions — this flaw was fixed in Microsoft's April 2019 security updates, so ensure systems are running those or later cumulative updates and verify by checking OS build numbers. Prioritize patching endpoints and servers where untrusted or low-privileged users can execute code, given documented ransomware chaining. Treat KEV status as a deadline: systems unpatched for this Win32k flaw should be considered actively targeted. | 7.8 | 45% | KEV ransomware |
| masshundreds of millions of Windows desktops and servers (Win32k is a core component shipped with essentially all Windows installations) |
Full article472 words · extracted from thehackernews.com · click to collapse
The Hacker NewsApr 09, 2019
Microsoft today released its April 2019 software updates to address a total of 74 CVE-listed vulnerabilities in its Windows operating systems and other products, 13 of which are rated critical and rest are rated Important in severity.
April 2019 security updates address flaws in Windows OS, Internet Explorer, Edge, MS Office, and MS Office Services and Web Apps, ChakraCore, Exchange Server, .NET Framework and ASP.NET, Skype for Business, Azure DevOps Server, Open Enclave SDK, Team Foundation Server, and Visual Studio.
None of the vulnerabilities addressed this month by the tech giant were disclosed publicly at the time of release, leaving the two recently disclosed zero-day flaws in Internet Explorer and Edge browsers still open for hackers.
However, two new privilege escalation vulnerabilities, which affect all supported versions of the Windows operating system, have been reported as being actively exploited in the wild.
Both rated as important, the flaws (CVE-2019-0803 and CVE-2019-0859) reside in the Win32k component of Windows operating system that could be exploited by attackers to run arbitrary code in kernel mode on a targeted computer.
Just last month Microsoft patched two similar vulnerabilities in the Win32k component that were also being exploited in targeted attacks by several threat actors including, FruityArmor and SandCat.
Besides this, Microsoft also released updates to patch 13 critical vulnerabilities, and as expected, all of the critical-rated vulnerabilities lead to remote code execution attacks, except one elevation of privileges in Windows Server Message Block (SMB) Server.
All critical vulnerabilities primarily impact various versions of Windows 10 operating system and Server editions and reside in ChakraCore Scripting Engine, Microsoft XML Core Services, SMB Server, Windows IOleCvt Interface, and Windows Graphics Device Interface (GDI).
Many important-rated vulnerabilities also lead to remote code execution attacks, while others allow elevation of privilege, information disclosure, cross-site scripting (XSS), spoofing and denial of service attacks.
Users and system administrators are highly recommended to apply the latest security patches as soon as possible to keep cybercriminals and hackers away from taking control of their computers.
For installing the latest security updates, you can head on to Settings → Update & Security → Windows Update → Check for updates on your computer, or you can install the updates manually.
For addressing problematic update issues on Windows 10 devices, Microsoft last month also introduced a safety measure that automatically uninstalls buggy software updates installed on your system if your OS detects a startup failure.
Adobe also rolled out security updates today to fix 40 security vulnerabilities in several of its products. Users of the affected Adobe software for Windows, macOS, Linux, and Chrome OS are advised to update their software packages to the latest versions.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2019/04/microsoft-patch-updates.html