With the release of the September 2019 security updates, Microsoft has released 2 advisories and updates for 79 vulnerabilities. Of these vulnerabilities, 17 are classified as Critical. according to reports.
With the release of the September 2019 security updates, Microsoft has released 2 advisories and updates for 79 vulnerabilities. Of these vulnerabilities, 17 are classified as Critical. according to reports.
Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics
This month’s Patch Tuesday release contains updates for nearly 80 CVEs, including four critical vulnerabilities in the Remote Desktop Client, and two Elevation of Privilege vulnerabilities exploited in the wild as zero-days.
Since Microsoft warned about BlueKeep (CVE-2019-0708) in May, Microsoft’s Platform Security Assurance & Vulnerability Research team identified additional vulnerabilities in Remote Desktop, patching four critical flaws in August in Remote Desktop Services, dubbed “DejaBlue.” This month, Microsoft’s internal research teams identified four new critical vulnerabilities in Remote Desktop Client (CVE-2019-1290, CVE-2019-1291, CVE-2019-0787, CVE-2019-0788). Unlike BlueKeep and DejaBlue, where attackers target vulnerable Remote Desktop servers, these vulnerabilities require an attacker to convince a user to connect to a malicious Remote Desktop server. Attackers could also compromise vulnerable servers and host malicious code on them and wait for users to connect to them.
Microsoft also patched two vulnerabilities that were exploited in the wild as zero-days. CVE-2019-1214 is an elevation of privilege vulnerability in the Windows Common Log File System (CLFS) Driver, while CVE-2019-1215 is an elevation of privilege vulnerability in the Winsock IFS Driver (ws2ifsl.sys). Both flaws exist due to improper handling of objects in memory by the respective drivers. Elevation of Privilege vulnerabilities are utilized by attackers post-compromise, once they’ve managed to gain access to a system in order to execute code on their target systems with elevated privileges.