VERT Threat Alert: September 2018 Patch Tuesday Analysis
Today’s VERT Alert addresses Microsoft’s September 2018 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-796 on Wednesday, September 12th.
In-The-Wild & Disclosed CVEs
CVE-2018-8440
This vulnerability was disclosed on Twitter on August 27th, and a high level analysis was published on August 28th. More recently, ESET published a write-up on the vulnerability after it was used in malware. The vulnerability takes advantage of a flaw in the task scheduler ALPC (Advanced Local Procedure Call) to escalate privileges.
Microsoft has rated this as a 1 on the Exploitability Index (Exploitation More Likely)
CVE-2018-8475
Microsoft has stated that this vulnerability has already been publicly disclosed, and it appears to present significant risk. A vulnerability in how Windows handles image files means that exploitation can occur simply by viewing the image.
Microsoft has rated this as a 1 on the Exploitability Index (Exploitation More Likely)
CVE-2018-8457
A vulnerability exists in the scripting engine found in Microsoft browsers around their method of handling objects in memory. Successful exploitation of the vulnerability could lead to code execution in the context of the current user. The update changes how the scripting engine handles objects in memory.
Microsoft has rated this as a 1 on the Exploitability Index (Exploitation More Likely)
CVE-2018-8409
This denial-of-service vulnerability impacts System.IO.Piplines available in .NET Core and ASP.NET Core. Microsoft has released a detailed write-up as part of the ASP.NET Core project.
Microsoft has rated this as a 2 on the Exploitability Index (Exploitation Less Likely)
Other Information
In addition to the Microsoft vulnerabilities included in the September Security Guidance, a pair of security advisories were also made available.
Windows Denial of Service Vulnerability [ADV180022]
Microsoft has released an advisory for CVE-2018-5391 (“FragmentSmack”), which allows attackers to (Read more...)
*** This is a Security Bloggers Network syndicated blog from The State of Security authored by Tyler Reguly. Read the original post at: https://www.tripwire.com/state-of-security/vert/vert-threat-alert-september-2018-patch-tuesday-analysis/