Tripwire Patch Priority Index for September 2018

Image

Tripwire's September 2018 Patch Priority Index (PPI) brings together the top vulnerabilities from Microsoft and Adobe. First on the patch priority list this month are patches for Microsoft's Internet Explorer, Edge and Scripting Engine. These patches resolve 18 vulnerabilities, including fixes for Elevation of Privilege, Information Disclosure, Memory Corruption, Security Feature Bypass and Spoofing vulnerabilities. Note that this list contains CVE-2018-8457 for Scripting Engine, and Microsoft has rated this as Exploitation More Likely on the Exploitability Index. Next on the patch priority list this month are patches released by Adobe and described in the APSB18-31 security bulletin. This patch set includes updates for an information disclosure vulnerability in Adobe Flash Player 30.0.0.154 and earlier versions for Windows, Macintosh, Linux and Chrome OS. Up next, administrators should focus on patching two specific Windows vulnerabilities. First, there is CVE-2081-8440 for the Windows Advanced Local Procedure Call (ALPC). This vulnerability allows an attacker to take advantage of a flaw in the task scheduler ALPC to escalate privileges. This vulnerability has been publicly disclosed with details available describing how it was used in malware. Second, there is CVE-2018-8475, which is a remote code execution vulnerability based on how Windows handles image files. Microsoft has rated both of these vulnerabilities with a 1 on the Exploitability Index, meaning that exploitation is more likely. Next on the list are the remaining patches for Microsoft Windows. These patches address numerous vulnerabilities across Device Guard, DirectX Graphics Kernel, Windows Kernel, MS XML, Graphics component, JET Database Engine, Win32k Graphics, Windows GDI, Hyper-V, Registry, SMB and Windows Subsystem for Linux. Lastly for this month, users should focus on the patches for Microsoft Office, SharePoint and .NET. These patches resolve information disclosure, remote code execution, XSS and Elevation of Privilege vulnerabilities. To learn more about Tripwire’s Vulnerability and Exposure Research Team (VERT), click here.