Tripwire Patch Priority Index for May 2019

Image

Tripwire's May 2019 Patch Priority Index (PPI) brings together important vulnerabilities from Microsoft and Adobe. First and most importantly this month are the patches available to resolve the BlueKeep (CVE-2019-0708) Remote Desktop Services remote code execution vulnerability. As noted by Microsoft:

[This] remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP. The update addresses the vulnerability by correcting how Remote Desktop Services handles connection requests.

It is very important to note that Microsoft also released patches for some versions of Windows that no longer receive mainstream support. Patches for unsupported versions of Windows including Windows XP, Vista, and Server 2003 R2 are available here: https://support.microsoft.com/en-us/help/4500705/customer-guidance-for-cve-2019-0708. Patches for Windows 7, Server 2008 and Server 2008 R2 can be found from the MSRC security guidance page: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708. Newer versions of Windows are not prone to the BlueKeep vulnerability. Up next on the patch priority index this month are patches for Microsoft's Browser and Scripting Engine. These patches resolve 23 vulnerabilities including fixes for memory corruption, security feature bypass, spoofing and information disclosure vulnerabilities. Next on the list are patches for Adobe Flash Player (APSB19-19). Adobe has released patches for Adobe Flash Player for Windows, macOS, Linux and Chrome OS. These updates address a critical use-after-free vulnerability in Adobe Flash Player that can lead to arbitrary code execution in the context of the current user. Following Flash are patches for Adobe Reader and Adobe Acrobat via the APSB19-18 security bulletin. Adobe has released security updates for Adobe Acrobat and Reader for Windows and macOS. These updates address critical and important vulnerabilities.  Successful exploitation could lead to arbitrary code execution in the context of the current user. These patches resolve 84 vulnerabilities including out-of-bounds read, out-of-bounds write, type confusion, use-after-free, heap overflow, buffer error, double free and security bypass vulnerabilities that can lead to information disclosure and arbitrary code execution. Next on the list are patches for Microsoft Office Access and Word. These patches resolve four vulnerabilities including fixes for remove code execution vulnerabilities. Up next are patches for Microsoft Windows. These patches address vulnerabilities across Windows Kernel, Jet Database Engine, GDI/GDI+, Diagnostic Hub, Unified Write Filter, DCP Server, Defender Application Control, Error Reporting, Hyper-V, NDIS, OLE and Storage Service. These patches fix 30 vulnerabilities including elevation of privilege, information disclosure, security feature bypass and remote code execution vulnerabilities. Next on the patch priority index are patches for the .NET Framework and .NET Core, which address four denial of service vulnerabilities. Finally this month, administrators should focus on server-side patches available for Microsoft SharePoint, Team Foundation Server, Azure DevOps Server, SQL Server and Microsoft Dynamics. These patches resolve 13 vulnerabilities including elevation of privilege, spoofing, cross-site scripting, security feature bypass, remote code execution and information disclosure vulnerabilities.  

  To learn more about Tripwire’s Vulnerability and Exposure Research Team (VERT), click here. Or you can follow VERT on Twitter: @tripwirevert