Microsoft’s October 2018 Security Update: There's More to the Story
A week after Microsoft addressed 49 vulnerabilities in its October 2018 Security Update, new developments have emerged that change the threat profile of some of them.
Contexte
On Tuesday, October 9, Microsoft released its October 2018 Security Update, also known as Patch Tuesday. This security update contained fixes for 49 vulnerabilities. Since the publication of this security update, new developments have emerged that change the threat profile of some of these vulnerabilities. The most notable developments center around vulnerabilities in Microsoft Windows Shell, Microsoft Win32k.sys and Microsoft JET Database Engine.
Vulnerability details
On September 20, Trend Micro’s Zero Day Initiative (ZDI) published an advisory on CVE-2018-8423, a zero-day vulnerability in Microsoft Windows JET Database Engine. The advisory was published after researchers provided Microsoft with a responsible disclosure timeline of 120 days. Microsoft did release a patch for this vulnerability as part of the October 2018 Security Update. However, researchers from 0patch, a company that produces micropatches for vulnerable software, published a blog on October 12 claiming Microsoft’s patch for the JET Database Engine vulnerability was incomplete. At the time of publication, Microsoft has not responded to 0patch’s claim.
On October 10, Kaspersky Lab researchers published a blog on CVE-2018-8453, a zero-day vulnerability in Win32k.sys that its researchers discovered being exploited in the wild by an Advanced Persistent Threat (APT) group known as FruityArmor. This zero-day is an elevation of privilege vulnerability packaged as part of a malicious software (malware) installer used against less than 12 targets based in the Middle East region. Kaspersky notified Microsoft of this vulnerability in August 2018 and a patch was released as part of the October 2018 Security Update.
On October 11, researcher Abdulrahman Al-Qabandi published a blog around his discovery of a remote code execution vulnerability in Windows Shell, CVE-2018-8495. Al-Qabandi provided these details to the ZDI, which worked with Microsoft to address this issue in the October 2018 Security Update. In his blog, Al-Qabandi provides a Proof of Concept (PoC) revealing how the vulnerability can be exploited. The concern around a PoC being made available is that it provides malicious actors a blueprint to leverage this vulnerability to attack users in the wild.
Urgently required actions
Despite the claim that the patch for the JET Engine Database vulnerability is incomplete, customers are still advised to apply Microsoft’s October 2018 Security Update to all assets. Applying this update will address 49 CVEs, including the Win32k.sys and Windows Shell vulnerabilities.
It is unclear whether or not Microsoft will provide clarification about the claim made about the JET Engine Database vulnerability prior to the November 2018 Security Update. Until then, customers are advised to restrict interaction with vulnerable applications to trusted files.
While applying security updates and patches is vital, patching alone is just one part of a larger picture in securing assets. These developments underscore the importance of comprehensive security that encompasses having visibility into your assets, contextualizing potential risks to prioritize responses and taking action to close the Cyber Exposure gap.
Identification des systèmes affectés
A list of Nessus plugins to identify vulnerable assets can be found here.
Où trouver plus d'informations
- Microsoft Windows Jet Database Engine Out-Of-Bounds Write Remote Code Execution Vulnerability
- Patching, Re-Patching and Meta-Patching the Jet Database Engine RCE (CVE-2018-8423)
- Zero-day exploit (CVE-2018-8453) used in targeted attacks
- Microsoft Edge Remote Code Execution
- Microsoft Fixes Privilege Escalation 0Day Under Active Attack
- Microsoft Patch Tuesday update covers zero-day, 12 critical issues
Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.
Articles connexes
Cybersecurity Snapshot: Attackers Pounce on Unpatched Vulns, DBIR Says, as Critical Infrastructure Orgs Benefit from CISA’s Alert Program
May 3, 2024Verizon’s DBIR found that hackers are having a field day exploiting vulnerabilities to gain initial access. Plus, a CISA program is helping critical infrastructure organizations prevent ransomware attacks. In addition, check out what Tenable’s got planned for RSA Conference 2024. And get the latest on the Change Healthcare breach. And much more!
As Pro-Russia Hactivists Target OT Systems, Here’s What You Need To Know
May 2, 2024U.S. and international cybersecurity and law enforcement agencies this week issued a joint fact sheet to highlight and safeguard against the continued malicious cyber activity conducted by pro-Russia hacktivists against operational technology (OT) devices in North America and Europe. Read on to get all the details and learn what actions to take today.
Tenable Bolsters Its Cloud Security Arsenal with Malware Detection
May 1, 2024Tenable Cloud Security is enhancing its capabilities with malware detection. Combined with its cutting-edge, agentless vulnerability-scanning technology, including its ability to detect anomalous behavior, this new capability makes Tenable Cloud Security a much more complete and effective solution. Read on to find out how.
