Microsoft has just released their patches for the month of November and Greg Wiseman, Rapid7’s Senior Security Researcher has provided his thoughts below.
Greg Wiseman, Senior Security Researcher at Rapid7:
Back to Microsoft: no non-browser vulnerabilities are considered critical this month, but with a little bit of social engineering, an attacker could theoretically combine one of the Office-based RCE vulnerabilities like CVE-2017-11878 or CVE-2017-11882 with a Windows Kernel privilege escalation weakness such as CVE-2017-11847 to gain complete control over a system. Thankfully, none of the patched vulnerabilities this time around are known to be exploited in the wild.
Microsoft is also rolling out fixes to some of their open source projects, which is a relatively new trend. 16 of the Edge vulnerabilities have been resolved in ChakraCore, the open source part of Edge’s JavaScript engine. .NET Core is being patched for a denial of service (DoS) vulnerability (CVE-2017-11770), and ASP.NET Core has fixes for DoS (CVE-2017-11883), privilege escalation (CVE-2017-11879), and information disclosure (CVE-2017-8700) vulnerabilities this month. These aren’t updates in the traditional Microsoft sense, but fixes that developers should be sure are present when building software on top of these libraries.
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.