Tripwire Patch Priority Index for December 2018

Image

Tripwire's December 2018 Patch Priority Index (PPI) brings together the top vulnerabilities from Microsoft and Adobe. First on the patch priority list this month are patches for Microsoft's Internet Explorer and Scripting Engine. These patches resolve nine vulnerabilities, including fixes for Memory Corruption and Remote Code Execution (RCE) vulnerabilities. Next on the list are patches for Adobe Flash. These patches resolve a use-after-free vulnerability and a DLL hijacking vulnerability. These patches are available for Windows, macOS, Linux and Chrome OS.

(NOTE: Adobe is aware of reports that an exploit for CVE-2018-15982 exists in the wild.)

Up next are patches for Adobe Acrobat and Reader, and this month it is a whopper resolving 87 vulnerabilities. These updates address critical and important vulnerabilities, including fixes for buffer errors, untrusted pointer dereference, security bypass, use-after-free, out-of-bounds read, out-of-bounds write, heap overflow and integer overflow vulnerabilities. Up next are patches for Microsoft Office for Excel, Outlook and PowerPoint. These patches resolve six vulnerabilities, including Remote Code Execution (RCE) and Information Disclosure vulnerabilities. Next on the list are the patches for Microsoft Windows. These patches address multiple vulnerabilities across Win32k.sys, Azure, DNS server, Windows GDI, Windows Kernel and other Windows components. These patch various vulnerabilities, including XSS, Heap Overflow, Denial of Service, Elevation of Privilege (EoP), Information Disclosure and RCE vulnerabilities.

(NOTE: Microsoft is reporting that the CVE-2018-8611 Windows kernel privilege escalation vulnerability is seeing active exploitation on older versions of Windows.) Successful exploitation can allow an attacker to run code in kernel mode. This issue was resolved by changing how the Windows kernel handles objects in memory.

Next on the list are patches for the .NET Framework, with fixes for a Denial of Service vulnerability and a Remote Code Injection vulnerability.

(NOTE: The CVE-2018-8517 vulnerability is a publicly disclosed issue with the .NET Framework that could allow an unauthenticated attacker to DoS a .NET Framework based web application by sending malformed web requests.)

Finally, this month, administrators should focus on server-side patches for Microsoft Exchange, SharePoint and Dynamics 365. These patches resolve four vulnerabilities including XSS, EoP, Information Disclosure and Server Tampering vulnerabilities.  

  To learn more about Tripwire’s Vulnerability and Exposure Research Team (VERT), click here. Or you can follow them on Twitter: @tripwirevert