Microsoft May Madness

Patch Tuesday was anything but typical in the month of May. On May 8, Microsoft released security patches for a total of 67 vulnerabilities, addressing 21 critical vulnerabilities, 42 important and four low-severity, while Adobe addressed a critical flaw in Adobe Flash Player. This is a big push from Microsoft in securing Windows, coming right after the recent release of Windows 10, version 1803, which added several security improvements, among other feature updates.

However, what makes this update particularly important is that it addresses two zero-day vulnerabilities that are being actively exploited in the wild and a further two for which public exploits have been published.

The first critical vulnerability is the Internet Explorer (IE) Double Kill vulnerability (CVE-2018-8174), which Tenable reported on in April 2018. The second zero-day is CVE-2018-8120, a privilege escalation vulnerability within the Win32k component. Microsoft also patched CVE-2018-8141 (Windows kernel information disclosure vulnerability) and CVE-2018-8170 (Windows image elevation of privilege vulnerability). Technical details, including exploits for both of these CVEs are public, but attackers don't seem to be taking advantage of them at the time of writing this post.

A patch for a critical Adobe Flash Player vulnerability (CVE-2018-4944) was also released as part of Adobe’s Patch Tuesday update.

Impact assessment

For anyone running Windows 10, all but one of the CVEs pose a considerable risk and represent an urgent security concern. These can lead to full system compromise if left unmitigated.

One zero-day, IE Double Kill, affects the current version of IE and other applications that use the browser. The other zero-day is the Win32k privilege escalation vulnerability that impacts Windows 7 and Server 2008 users. Both zero-day vulnerabilities permit privilege escalation and full system compromise if exploited.

Vulnerability details

Microsoft’s May security release includes security updates for the following applications:

• Internet Explorer
• Microsoft Edge
• Microsoft Windows
• Microsoft Office and Microsoft Office Services and Web Apps
• ChakraCore
• Adobe Flash Player
• .NET Framework
• Microsoft Exchange Server
• Windows Host Compute Service Shim

The most critical fixes in this security update are for Internet Explorer and Microsoft Windows. Also contained within the update are several patches for Office, Outlook and SharePoint rated as important. An Exchange update and the .NET Framework also have a couple of patches rated Important.

CVE-2018-8174, aka “IE Double-kill”, is being actively exploited in the wild. Additional details on this vulnerability can be found here. This is an extremely dangerous vulnerability, as it not only targets the browser, but also affects ActiveX controls and embedded scripts in Office documents. Until a patch has been applied, attackers can potentially force Internet Explorer to load, even if IE is not the default browser.

CVE-2018-8120, a privilege escalation vulnerability within the Win32k component, is also being actively exploited in the wild and is rated as “Important.” It only affects Windows 7, Windows Server 2008 and Windows Server 2008 R2.

Urgently required actions

Due to public exploit availability and the active exploitation of these vulnerabilities, we recommend that users urgently install the security updates to protect themselves.

Tenable has the following Nessus plugins for detection of the vulnerabilities for CVE-2018-8174, CVE-2018-8120, CVE-2018-8141 and CVE-2018-8170.

Get more information:

• Microsoft Security TechCenter
• Adobe Security Bulletin
• Learn more about Tenable.io®, the first Cyber Exposure platform for holistic management of your modern attack surface
• Get a free 60-day trial of Tenable.io Vulnerability Management