Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

Microsoft May Madness

Patch Tuesday was anything but typical in the month of May. On May 8, Microsoft released security patches for a total of 67 vulnerabilities, addressing 21 critical vulnerabilities, 42 important and four low-severity, while Adobe addressed a critical flaw in Adobe Flash Player. This is a big push from Microsoft in securing Windows, coming right after the recent release of Windows 10, version 1803, which added several security improvements, among other feature updates.

However, what makes this update particularly important is that it addresses two zero-day vulnerabilities that are being actively exploited in the wild and a further two for which public exploits have been published.

The first critical vulnerability is the Internet Explorer (IE) Double Kill vulnerability (CVE-2018-8174), which Tenable reported on in April 2018. The second zero-day is CVE-2018-8120, a privilege escalation vulnerability within the Win32k component. Microsoft also patched CVE-2018-8141 (Windows kernel information disclosure vulnerability) and CVE-2018-8170 (Windows image elevation of privilege vulnerability). Technical details, including exploits for both of these CVEs are public, but attackers don't seem to be taking advantage of them at the time of writing this post.

A patch for a critical Adobe Flash Player vulnerability (CVE-2018-4944) was also released as part of Adobe’s Patch Tuesday update.

Impact assessment

For anyone running Windows 10, all but one of the CVEs pose a considerable risk and represent an urgent security concern. These can lead to full system compromise if left unmitigated.

One zero-day, IE Double Kill, affects the current version of IE and other applications that use the browser. The other zero-day is the Win32k privilege escalation vulnerability that impacts Windows 7 and Server 2008 users. Both zero-day vulnerabilities permit privilege escalation and full system compromise if exploited.

Vulnerability details

Microsoft’s May security release includes security updates for the following applications:

  • Internet Explorer
  • Microsoft Edge
  • Microsoft Windows
  • Microsoft Office and Microsoft Office Services and Web Apps
  • ChakraCore
  • Adobe Flash Player
  • .NET Framework
  • Microsoft Exchange Server
  • Windows Host Compute Service Shim

The most critical fixes in this security update are for Internet Explorer and Microsoft Windows. Also contained within the update are several patches for Office, Outlook and SharePoint rated as important. An Exchange update and the .NET Framework also have a couple of patches rated Important.

CVE-2018-8174, aka “IE Double-kill”, is being actively exploited in the wild. Additional details on this vulnerability can be found here. This is an extremely dangerous vulnerability, as it not only targets the browser, but also affects ActiveX controls and embedded scripts in Office documents. Until a patch has been applied, attackers can potentially force Internet Explorer to load, even if IE is not the default browser.

CVE-2018-8120, a privilege escalation vulnerability within the Win32k component, is also being actively exploited in the wild and is rated as “Important.” It only affects Windows 7, Windows Server 2008 and Windows Server 2008 R2.

Urgently required actions

Due to public exploit availability and the active exploitation of these vulnerabilities, we recommend that users urgently install the security updates to protect themselves.

Tenable has the following Nessus plugins for detection of the vulnerabilities for CVE-2018-8174, CVE-2018-8120, CVE-2018-8141 and CVE-2018-8170.

Plugin ID

Description

109604

KB4103712: Windows 7 and Windows Server 2008 R2 May 2018 Security Update

109610

KB4103726: Windows Server 2012 May 2018 Security Update

109607

KB4103715: Windows 8.1 and Windows Server 2012 R2 May 2018 Security Update

109606

KB4103723: Windows 10 Version 1607 and Windows Server 2016 May 2018 Security Update

109608

KB4103727: Windows 10 Version 1709 May 2018 Security Update

109611

KB4103716: Windows 10 May 2018 Security Update

109605

KB4103721: Windows 10 Version 1803 May 2018 Security Update

109603

KB4103731: Windows 10 Version 1703 May 2018 Security Update

Get more information:

Related Articles

Cybersecurity News You Can Use

Enter your email and never miss timely alerts and security guidance from the experts at Tenable.