Skip to main content
Tag

November Patch Tuesday

||

November Patch Tuesday: Windows Zero-Day Exploit Patched

By News, Patch Management, Patch TuesdayNo Comments
[vc_single_image image=”25731″ img_size=”full”]

Patch Tuesday Release: The Latest News

Microsoft has released 62 security patches today covering Internet Explorer (IE), Edge, ChakraCore, Hyper-V, Exchange, Windows components, .NET Core, SQL Server, and Microsoft Office.  12 of the 62 are listed as Critical.

CVE-2018-8589 with a severity of Important and a CVSS score of 7.8 is being actively exploited.  The most likely exploitation of this type of vulnerability is thought by many experts to be by global malware making this a very serious vulnerability.  We would highly recommend this be a priority for your IT Manager this month.

Patch Tuesday needed to fix file association bug

A cumulative update for Windows 10 from April 2018 has broken the file association settings with certain applications.

If this has impacted your users, we would recommend you include the patch in your next round of patch deployments. We have learned some third-party updates by Notepad++, which is a popular application used by software developers, loses its association with certain text file formats.

Robert Brown, Director of Services for Verismic said, “From our own experience of deploying tens of millions of updates worldwide, it is always the smallest bugs which impact your users the most and cause huge disruption in your users’ productivity.  We encourage all of our customers to have a robust testing process to ensure interruption to your workforce is minimized.

Adobe Fixes Critical Vulnerabilities

Adobe released their monthly patch list early this month, three additional updates have been released affecting Flash, Adobe Photoshop & Acrobat / Reader.

One of the three vulnerabilities identified as CVE-2018-15979 is currently being exploited, so if you are using Acrobat or Reader on your devices we would highly recommend this patch be prioritized.

[dt_default_button link=”url:https%3A%2F%2Fwww.syxsense.com%2Fsyxsense-trial%2F|||” size=”big” button_alignment=”btn_center”]START FREE TRIAL[/dt_default_button]
[vc_empty_space][vc_separator][vc_empty_space]

Patch Tuesday Release

CVE Reference  Title   Severity   Publicly Disclosed   Actively Exploited  Recommended
 CVE-2018-8589  Windows Win32k Elevation of Privilege Vulnerability  Important  No  Yes  Yes
 CVE-2018-8584  Windows ALPC Elevation of Privilege Vulnerability  Important  Yes   No Yes
 CVE-2018-8566  BitLocker Security Feature Bypass Vulnerability  Important  Yes   No Yes
 CVE-2018-8476  Windows Deployment Services TFTP Server Remote Code Execution Vulnerability  Critical   No  No Yes
 CVE-2018-8553  Microsoft Graphics Components Remote Code Execution Vulnerability  Critical   No  No Yes
 CVE-2018-8588  Chakra Scripting Engine Memory Corruption Vulnerability  Critical   No  No Yes
 CVE-2018-8541  Chakra Scripting Engine Memory Corruption Vulnerability  Critical   No  No Yes
 CVE-2018-8542  Chakra Scripting Engine Memory Corruption Vulnerability  Critical   No  No Yes
 CVE-2018-8543  Chakra Scripting Engine Memory Corruption Vulnerability  Critical   No  No Yes
 CVE-2018-8544  Windows VBScript Engine Remote Code Execution Vulnerability  Critical   No  No Yes
 CVE-2018-8555  Chakra Scripting Engine Memory Corruption Vulnerability  Critical   No  No Yes
 CVE-2018-8556  Chakra Scripting Engine Memory Corruption Vulnerability  Critical   No  No Yes
 CVE-2018-8557  Chakra Scripting Engine Memory Corruption Vulnerability  Critical   No  No Yes
 CVE-2018-8551  Chakra Scripting Engine Memory Corruption Vulnerability  Critical   No  No Yes
CVE-2018-8609 Microsoft Dynamics 365 (on-premises) version 8 Remote Code Execution Vulnerability  Critical   No  No Yes
CVE-2018-8600  Azure App Service Cross-site Scripting Vulnerability  Important  No  No
CVE-2018-8602  Team Foundation Server Cross-site Scripting Vulnerability  Important  No  No
CVE-2018-8605  Microsoft Dynamics 365 (on-premises) version 8 Cross Site Scripting Vulnerability  Important  No  No
CVE-2018-8606  Microsoft Dynamics 365 (on-premises) version 8 Cross Site Scripting Vulnerability  Important  No  No
CVE-2018-8607  Microsoft Dynamics 365 (on-premises) version 8 Cross Site Scripting Vulnerability  Important  No  No
CVE-2018-8608  Microsoft Dynamics 365 (on-premises) version 8 Cross Site Scripting Vulnerability  Important  No  No
 CVE-2018-8471  Microsoft RemoteFX Virtual GPU miniport driver Elevation of Privilege Vulnerability  Important  No  No
 CVE-2018-8485  DirectX Elevation of Privilege Vulnerability  Important  No  No
 CVE-2018-8554  DirectX Elevation of Privilege Vulnerability  Important  No  No
 CVE-2018-8561  DirectX Elevation of Privilege Vulnerability  Important  No  No
 CVE-2018-8562  Win32k Elevation of Privilege Vulnerability  Important  No  No
 CVE-2018-8572  Microsoft SharePoint Elevation of Privilege Vulnerability  Important  No  No
 CVE-2018-8581  Microsoft Exchange Server Elevation of Privilege Vulnerability  Important  No  No
 CVE-2018-8550  Windows COM Elevation of Privilege Vulnerability  Important  No  No
 CVE-2018-8552  Windows VBScript Engine Remote Code Execution Vulnerability  Important  No  No
 CVE-2018-8568  Microsoft SharePoint Elevation of Privilege Vulnerability  Important  No  No
 CVE-2018-8592  Windows Elevation Of Privilege Vulnerability  Important  No  No
 CVE-2018-8567  Microsoft Edge Elevation of Privilege Vulnerability  Important  No  No
 CVE-2018-8563  DirectX Information Disclosure Vulnerability  Important  No  No
 CVE-2018-8407  MSRPC Information Disclosure Vulnerability  Important  No  No
 CVE-2018-8454  Windows Audio Service Information Disclosure Vulnerability  Important  No  No
 CVE-2018-8565  Win32k Information Disclosure Vulnerability  Important  No  No
 CVE-2018-8558  Microsoft Outlook Information Disclosure Vulnerability  Important  No  No
 CVE-2018-8408  Windows Kernel Information Disclosure Vulnerability  Important  No  No
 CVE-2018-8545  Microsoft Edge Information Disclosure Vulnerability  Important  No  No
 CVE-2018-8578  Microsoft SharePoint Information Disclosure Vulnerability  Important  No  No
 CVE-2018-8579  Microsoft Outlook Information Disclosure Vulnerability  Important  No  No
 CVE-2018-8256  PowerShell Remote Code Execution Vulnerability  Important  No  No
 CVE-2018-8522  Microsoft Outlook Remote Code Execution Vulnerability  Important  No  No
 CVE-2018-8576  Microsoft Outlook Remote Code Execution Vulnerability  Important  No  No
 CVE-2018-8524  Microsoft Outlook Remote Code Execution Vulnerability  Important  No  No
 CVE-2018-8539  Microsoft Word Remote Code Execution Vulnerability  Important  No  No
 CVE-2018-8573  Microsoft Word Remote Code Execution Vulnerability  Important  No  No
 CVE-2018-8574  Microsoft Excel Remote Code Execution Vulnerability  Important  No  No
 CVE-2018-8575  Microsoft Project Remote Code Execution Vulnerability  Important  No  No
 CVE-2018-8582  Microsoft Outlook Remote Code Execution Vulnerability  Important  No  No
 CVE-2018-8450  Windows Search Remote Code Execution Vulnerability  Important  No  No
 CVE-2018-8577  Microsoft Excel Remote Code Execution Vulnerability  Important  No  No
 CVE-2018-8570  Internet Explorer Memory Corruption Vulnerability  Important  No  No
 CVE-2018-8417  Microsoft JScript Security Feature Bypass Vulnerability  Important  No  No
 CVE-2018-8549  Windows Security Feature Bypass Vulnerability  Important  No  No
 CVE-2018-8564  Microsoft Edge Spoofing Vulnerability  Important  No  No
 CVE-2018-8547  Active Directory Federation Services XSS Vulnerability  Important  No  No
CVE-2018-8529  Team Foundation Server Remote Code Execution Vulnerability  Important  No  No
 CVE-2018-8569  Yammer Desktop Application Remote Code Execution Vulnerability  Important  No  No
 CVE-2018-8415  Microsoft Powershell Tampering Vulnerability  Important  No  No
 CVE-2018-8416  .NET Core Tampering Vulnerability  Moderate  No  No
 CVE-2018-8546  Microsoft Skype for Business Denial of Service Vulnerability
[dt_default_button link=”url:https%3A%2F%2Fwww.syxsense.com%2Fsyxsense-trial%2F|||” size=”big” btn_width=”btn_full_width” button_alignment=”btn_center” icon_type=”picker” icon_picker=”fas fa-angle-double-right” icon_align=”right”]START FREE TRIAL[/dt_default_button]
|

November Patch Tuesday: High-Speed Malware

By News, Patch TuesdayNo Comments
[vc_single_image image=”13170″ img_size=”full”]

Russia Caught On Top

Towards the end of October, we started to see a flow of ransomware attacks from Russia with called Bad Rabbit.

This epidemic has been targeting organizations and consumers, mostly in Russia but there have also been reports of victims in Ukraine and across Europe. Bad Rabbit was the latest in a wave of recent ransomware attacks sweeping across the globe.

This new exploit reiterated the fact that Microsoft patching alone is not sufficient to protect yourself or your infrastructure from these kind of attacks. This particular exploit needs to be exploited manually, a user is “duped” into thinking they are downloading a seemingly innocent Adobe Flash player update from what looks to be a legitimate website. Once activated Bad Rabbit then triggers the EthernalRomance exploit infection vector to spread within corporate networks in the same way as WannaCry and NotPetya.

James Rowney, Service Manager for Verismic said in an email “Patch management in this day and age is paramount, your platform of choice should be able to protect all major Operating Systems and vendor applications. Syxsense supports updates for Microsoft, Linux, Macintosh and long list of third party vendor applications so with CMS you can be assured that you have the ability to protect yourself.”

Malware speeds its way across the UK

Last week closer to home reports started to come in that fake speeding notices have been sent out across the UK which are being used to deliver malware. This new threat to the public is aimed at home users and is sent in the form of an email entitled Notice of Prosecution which claims to have photographic evidence and supplies a link. Clicking on the link will download banking malware to the victim’s device.

Should you receive an email of this kind the first things to look for are any grammatical errors or spelling mistakes, the mails also tend to have ridiculously high speeds recorded, 90mph in a 30mph zone for example.

Should you receive an email of this kind the first things to look for are any grammatical errors or spelling mistakes, the mails also tend to have ridiculously high speeds recorded, 90mph in a 30mph zone for example.

Police have advised people to delete any mails relating to Notice of Prosecution without opening them as all prosecution notices are send to the registered address of the vehicle by post. There was a similar strategy used in December 2016 so it seems the cyber criminals are out to ruin the holidays for some poor victims again this year.

[dt_default_button link=”url:https%3A%2F%2Fwww.syxsense.com%2Fsyxsense-trial%2F|||” size=”big” button_alignment=”btn_center”]START FREE TRAIL[/dt_default_button]

[vc_single_image image=”12852″ img_size=”180×180 px” alignment=”center”]

[vc_separator css=”.vc_custom_1494871528028{padding-top: 15px !important;padding-bottom: 5px !important;}”]

November Microsoft Patch Tuesday Release

Microsoft published its monthly security updates on November 14, 2017, addressing 53 vulnerabilities in Internet Explorer, Microsoft Edge, Microsoft Windows, Microsoft Office and Microsoft Office Services and Web Apps, ASP.NET Core and .NET Core, Chakra Core. The vulnerabilities could allow an attacker to execute arbitrary code, gain elevated privileges, bypass security protections, view sensitive information, or cause a denial of service. Full details of the complete Security Update Guide can be found here.

We have chosen a few updates to prioritise this month, this recommendation has been made using evidence from industry experts (including our own), anticipated business impact and most importantly the independent CVSS score for the vulnerability. The independent CVSS scores used in the table below range from 0 to 10. Vulnerabilities with a base score in the range 7.0-10.0 are High, those in the range 4.0-6.9 are Medium, and 0-3.9 are Low.

ID Vulnerability Alert CVSS Base Score Recommended
CVE-2017-11876 Microsoft Project Privilege Escalation Vulnerability 8.8 Yes
CVE-2017-11827 Microsoft Edge and Internet Explorer Memory Corruption Vulnerability 7.5 Yes
CVE-2017-11855 Microsoft Internet Explorer Memory Corruption Vulnerability 7.5 Yes
CVE-2017-11856 Microsoft Internet Explorer Memory Corruption Vulnerability 7.5 Yes
CVE-2017-11869 Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability 7.5 Yes
CVE-2017-11847 Microsoft Windows Kernel Privilege Escalation Vulnerability 7 Yes
CVE-2017-11770 Microsoft ASP.NET Core Denial Of Service Vulnerability 5.9  
CVE-2017-11788 Microsoft Windows Search Denial of Service Vulnerability 5.9  
CVE-2017-11830 Microsoft Windows Device Guard Security Feature Bypass Vulnerability 5.3  
CVE-2017-11883 Microsoft ASP.NET Core Request Handling Denial Of Service Vulnerability 5.3  
CVE-2017-11831 Microsoft Windows Kernel Information Disclosure Vulnerability 4.7  
CVE-2017-11832 Microsoft Windows Embedded OpenType Font Engine Information Disclosure Vulnerability 4.7  
CVE-2017-11835 Microsoft Windows Embedded OpenType Font Engine Information Disclosure Vulnerability 4.7  
CVE-2017-11842 Microsoft Windows Kernel Information Disclosure Vulnerability 4.7  
CVE-2017-11849 Microsoft Windows Kernel Information Disclosure Vulnerability 4.7  
CVE-2017-11850 Microsoft Windows Graphics Component Information Disclosure Vulnerability 4.7
CVE-2017-11851 Microsoft Windows Kernel Information Disclosure Vulnerability 4.7
CVE-2017-11852 Microsoft Windows Graphics Component Information Disclosure Vulnerability 4.7
CVE-2017-11853 Microsoft Windows Kernel Information Disclosure Vulnerability 4.7
CVE-2017-11880 Microsoft Windows Kernel Information Disclosure Vulnerability 4.7
CVE-2017-11877 Microsoft Excel Security Feature Bypass Vulnerability 4.4
CVE-2017-8700 Microsoft ASP.NET Core Information Disclosure Vulnerability 4.3  
CVE-2017-11791 Microsoft Edge and Internet Explorer Scripting Engine Information Disclosure Vulnerability 4.3  
CVE-2017-11803 Microsoft Edge Information Disclosure Vulnerability 4.3  
CVE-2017-11833 Microsoft Edge Information Disclosure Vulnerability 4.3
CVE-2017-11834 Microsoft Internet Explorer Scripting Engine Information Disclosure Vulnerability 4.3
CVE-2017-11844 Microsoft Edge Information Disclosure Vulnerability 4.3
CVE-2017-11848 Microsoft Internet Explorer Information Disclosure Vulnerability 4.3
CVE-2017-11872 Microsoft Edge Security Feature Bypass Vulnerability 4.3
CVE-2017-11879 Microsoft ASP.NET Core URL Redirection Vulnerability 4.3
CVE-2017-11836 Microsoft Edge Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11837 Microsoft Edge and Internet Explorer Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11838 Microsoft Edge and Internet Explorer Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11839 Microsoft Edge Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11840 Microsoft Edge Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11841 Microsoft Edge Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11843 Microsoft Edge and Internet Explorer Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11845 Microsoft Edge Memory Corruption Vulnerability 4.2
CVE-2017-11846 Microsoft Edge and Internet Explorer Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11854 Microsoft Word Memory Corruption Vulnerability 4.2
CVE-2017-11858 Microsoft Edge and Internet Explorer Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11861 Microsoft Edge Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11862 Microsoft Edge Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11863 Microsoft Edge Security Feature Bypass Vulnerability 4.2
CVE-2017-11866 Microsoft Edge Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11870 Microsoft Edge Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11871 Microsoft Edge Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11873 Microsoft Edge Scripting Engine Memory Corruption Vulnerability 4.2
CVE-2017-11874 Microsoft Edge Security Feature Bypass Vulnerability 4.2
CVE-2017-11878 Microsoft Excel Memory Corruption Vulnerability 4.2
CVE-2017-11882 Microsoft Office Memory Corruption Vulnerability 4.2
CVE-2017-11768 Microsoft Windows Media Player Information Disclosure Vulnerability 2.5
[vc_separator css=”.vc_custom_1494871528028{padding-top: 15px !important;padding-bottom: 5px !important;}”][dt_default_button link=”url:https%3A%2F%2Fwww.syxsense.com%2Fsyxsense-trial%2F|||” size=”big” button_alignment=”btn_center” icon_type=”picker” icon_picker=”fas fa-angle-double-right” icon_align=”right”]START YOUR FREE TRIAL OF SYXSENSE[/dt_default_button]
|

November Patch Tuesday: From Science Fiction to Fact

By Patch Management, Patch Tuesday, UncategorizedNo Comments
[vc_single_image source=”featured_image”]

Old School Macros Finally Get Blocked

Today Microsoft have released 14 bulletins in total of which 6 are rated Critical and 8 are rated Important. Last week Microsoft also released 25 KB updates covering Office version 2010, 2013 and 2016.

Full details of that release can be found here. A couple months back we observed a trend where new age hackers were using old school techniques to expose a vulnerability in a system and to use that vulnerability to exploit malicious attacks. One of the newest features of Microsoft Office 2016 allows enterprise administrators to block users from running Macros inside Office documents that have originated from the Internet.

It does appear that Microsoft have also witnessed this trend and have made changes in order to protect their customers. We have also just learned that shortly they will be downgrading that functionality to Office 2013 enabling the same security to work in the same way it does in Office 2016. Robert Brown, Director of Services for Verismic says, “It’s great Microsoft are listening to their customers and their concerns.”

Office 2013 still has a massive market share with customers either unwilling or unable to upgrade quickly, offering this safety feature to Office 2013 will enable those customers to plan their upgrades properly and without the immediate urgency.

Microsoft are also adding detections for the BrowserModifier:Win32/Soctuseer rootkit in this month’s security release, helping to lessen interference to your browsing experience. No matter how it attempts to hide, though, most Soctuseer installations and system modifications will be uncovered and removed by the Microsoft Malicious Software Removal Tool (MSRT). We recommend our customers include this security update this within their monthly patching process, especially since it has been reported this month that one in three cyberattacks result in a security breach.

Twitter and Spotify “Dynied”

Shopping and social media sites were hit with a massive DDoS attack last week which caused three of the big names to be taken offline. Well known social media site Twitter and music sharing site Spotify are among the big names affected with many more suffering service disruptions. The focus of this attack was a company called Dyn who provide internet traffic to company websites as a service. It is believed by security analysts that the attack vector used “internet of things” as its way in.

For those not familiar, the internet of things or IoT is a term used to describe any user device which connects to the internet. Today’s IoT can be washing machines, heating controllers, IP CCTV, cars and even wireless baby monitors. Dyn provide a DNS service to large companies and was attacked using millions of devices commonly known as “bots” (unbeknown to the end user) on a “botnet” which were all infected with the “Mirai” malware.

The majority of these attacks originate in Asia and this DDoS was one was one of the largest out of China this year. Miari is a nasty little bug that trawls web for IoT devices with little or no protection and pre-set factory default access credentials. Once discovered, Mairi enlists the devices into its own botnet and proceeds to bombard targets with an overwhelming amount of requests / messages designed to overload the system and bring the website down. Cyber security expert Brian Krebs knows about this kind of attack all too well. A DDoS attack was launched on his site back in September with data overloads reaching 620 gigabits per second at its peak.

[vc_single_image image=”11071″]

James Rowney, Verismic Services Manager, commented “Attacks like these have been written into science fiction horror for decades, this is no longer science fiction, this is science fact. Be extra vigilant with your IT security.”

Set all network connected devices to use secure UserID and passwords, this is the first step to protecting yourself from being exploited in this manner.. If possible try to disconnect or power off devices that are not in use, might save you some electricity too!”

[dt_default_button link=”url:https%3A%2F%2Fwww.syxsense.com%2Fsyxsense-trial%2F|||” size=”big” button_alignment=”btn_center”]START FREE TRIAL[/dt_default_button]

Microsoft Updates

This month to help your IT Security Officers we have chosen a few updates from the Microsoft Patch Tuesday to prioritize this month. This recommendation has been made using evidence from industry experts (including our own), anticipated business impact and most importantly the independent CVSS score for the vulnerability.

MS16-129 – The update addresses the vulnerabilities by modifying how Microsoft browsers handles objects in memory, changing how the XSS filter in Microsoft browsers handle RegEx, modifying how the Chakra JavaScript scripting engine handles objects in memory and correcting how Microsoft Edge parses HTTP responses. This vulnerability has been publicly disclosed.

MS16-130 – The security update addresses the vulnerabilities by correcting how the Windows Input Method Editor (IME) loads DLLs requiring hardened UNC paths be used in scheduled tasks

MS16-132 – This update is actively being exploited which is why we recommend this be deployed as a priority this month. The security update addresses the vulnerabilities by correcting how the ATMFD component, the Windows Animation Manager, and the Windows Media Foundation handle objects in memory.

MS16-135 – Although this update is only marked as Important, the CVSS score tells us otherwise. It is also publically disclosed and has active exploits. We believe this should also be your priority this month.

The independent CVSS scores used in the table below range from 0 to 10. Vulnerabilities with a base score in the range 7.0-10.0 are High, those in the range 4.0-6.9 as Medium, and 0-3.9 as Low.

Bulletin ID Description Impact Restart Requirement Publically Disclosed Exploited Severity CVSS Score
MS16-129 Cumulative Security Update for Microsoft Edge (3199057)

This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than users with administrative user rights.

Remote Code Execution Yes Yes No Critical 9.3
MS16-130 Security Update for Microsoft Windows (3199172)

This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if a locally authenticated attacker runs a specially crafted application.

Remote Code Execution Yes No No Critical 9.3
MS16-131 Security Update for Microsoft Video Control (3199151)

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution when Microsoft Video Control fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. However, an attacker must first convince a user to open either a specially crafted file or a program from either a webpage or an email message.

Remote Code Execution Yes No No Critical 9.3
MS16-132 Security Update for Microsoft Graphics Component (3199120)
This security update resolves vulnerabilities in Microsoft Windows. The most severe being of the vulnerabilities could allow a remote code execution vulnerability exists when the Windows Animation Manager improperly handles objects in memory if a user visits a malicious webpage. An attacker who successfully exploited the vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights.
Remote Code Execution Yes No Yes Critical 9.3
MS16-133 Security Update for Microsoft Office (3199168)

This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Remote Code Execution Maybe No No Important 9.3
MS16-134 Security Update for Common Log File System Driver (3193706)

This security update resolves vulnerabilities in Microsoft Windows. The vulnerability could allow elevation of privilege when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. In a local attack scenario, an attacker could exploit these vulnerabilities by running a specially crafted application to take complete control over the affected system. An attacker who successfully exploits this vulnerability could run processes in an elevated context.

 

Elevation of Privilege Yes No No Important 7.2
MS16-135 Security Update for Windows Kernel-Mode Drivers (3199135)

This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application that could exploit the vulnerabilities and take control of an affected system.

 

Elevation of Privilege Yes Yes Yes Important 7.2
MS16-136 Security Update for SQL Server (3199641)

This security update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker could to gain elevated privileges that could be used to view, change, or delete data; or create new accounts. The security update addresses these most severe vulnerabilities by correcting how SQL Server handles pointer casting.

 

Elevation of Privilege Maybe No No Important 9.0
MS16-137 Security Update for Windows Authentication Methods (3199173)

This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow elevation of privilege. To exploit this vulnerability, the attacker would first need to authenticate to the target, domain-joined system using valid user credentials. An attacker who successfully exploited this vulnerability could elevate their permissions from unprivileged user account to administrator. The attacker could then install programs; view, change or delete data; or create new accounts. The attacker could subsequently attempt to elevate by locally executing a specially crafted application designed to manipulate NTLM password change requests.

 

Elevation of Privilege Yes No No Important 7.2
MS16-138 Security Update to Microsoft Virtual Hard Disk Driver (3199647)

This security update resolves vulnerabilities in Microsoft Windows. The Windows Virtual Hard Disk Driver improperly handles user access to certain files. An attacker could manipulate files in locations not intended to be available to the user by exploiting this vulnerability.

 

Elevation of Privilege Yes No No Important NA
MS16-139 Security Update for Windows Kernel (3199720)

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker runs a specially crafted application to access sensitive information. A locally authenticated attacker could attempt to exploit this vulnerability by running a specially crafted application. An attacker can gain access to information not intended to be available to the user by using this method.

 

Elevation of Privilege Yes No No Important 7.2
MS16-140 Security Update for Boot Manager (3193479)

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow security feature bypass if a physically-present attacker installs an affected boot policy.

 

Security Feature Bypass Yes No No Important 1.7
MS16-141 Security Update for Adobe Flash Player (3202790)

This security update resolves vulnerabilities in Adobe Flash Player when installed on all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows Server 2016.

 

Remote Code Execution Yes NA NA Critical NA
MS16-142 Cumulative Security Update for Internet Explorer (3198467)

This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

 

Remote Code Execution Yes Yes No Critical 9.3
[dt_default_button link=”url:https%3A%2F%2Fwww.syxsense.com%2Fsyxsense-trial%2F|||” size=”big” button_alignment=”btn_center” icon_type=”picker” icon_picker=”fas fa-angle-double-right” icon_align=”right”]START YOUR FREE TRIAL OF SYXSENSE[/dt_default_button]

Get Started

Start a free, 14-day trial of Syxsense, which helps organizations from 50 to 10,000 endpoints monitor and manage their environment, all from just a web browser. An email will be automatically sent to the address you provide.