Microsoft’s October 2018 Security Update: There's More to the Story

A week after Microsoft addressed 49 vulnerabilities in its October 2018 Security Update, new developments have emerged that change the threat profile of some of them.

背景說明

On Tuesday, October 9, Microsoft released its October 2018 Security Update, also known as Patch Tuesday. This security update contained fixes for 49 vulnerabilities. Since the publication of this security update, new developments have emerged that change the threat profile of some of these vulnerabilities. The most notable developments center around vulnerabilities in Microsoft Windows Shell, Microsoft Win32k.sys and Microsoft JET Database Engine.

Vulnerability details

On September 20, Trend Micro’s Zero Day Initiative (ZDI) published an advisory on CVE-2018-8423, a zero-day vulnerability in Microsoft Windows JET Database Engine. The advisory was published after researchers provided Microsoft with a responsible disclosure timeline of 120 days. Microsoft did release a patch for this vulnerability as part of the October 2018 Security Update. However, researchers from 0patch, a company that produces micropatches for vulnerable software, published a blog on October 12 claiming Microsoft’s patch for the JET Database Engine vulnerability was incomplete. At the time of publication, Microsoft has not responded to 0patch’s claim.

On October 10, Kaspersky Lab researchers published a blog on CVE-2018-8453, a zero-day vulnerability in Win32k.sys that its researchers discovered being exploited in the wild by an Advanced Persistent Threat (APT) group known as FruityArmor. This zero-day is an elevation of privilege vulnerability packaged as part of a malicious software (malware) installer used against less than 12 targets based in the Middle East region. Kaspersky notified Microsoft of this vulnerability in August 2018 and a patch was released as part of the October 2018 Security Update.

On October 11, researcher Abdulrahman Al-Qabandi published a blog around his discovery of a remote code execution vulnerability in Windows Shell, CVE-2018-8495. Al-Qabandi provided these details to the ZDI, which worked with Microsoft to address this issue in the October 2018 Security Update. In his blog, Al-Qabandi provides a Proof of Concept (PoC) revealing how the vulnerability can be exploited. The concern around a PoC being made available is that it provides malicious actors a blueprint to leverage this vulnerability to attack users in the wild.

Urgently required actions

Despite the claim that the patch for the JET Engine Database vulnerability is incomplete, customers are still advised to apply Microsoft’s October 2018 Security Update to all assets. Applying this update will address 49 CVEs, including the Win32k.sys and Windows Shell vulnerabilities.

It is unclear whether or not Microsoft will provide clarification about the claim made about the JET Engine Database vulnerability prior to the November 2018 Security Update. Until then, customers are advised to restrict interaction with vulnerable applications to trusted files.

While applying security updates and patches is vital, patching alone is just one part of a larger picture in securing assets. These developments underscore the importance of comprehensive security that encompasses having visibility into your assets, contextualizing potential risks to prioritize responses and taking action to close the Cyber Exposure gap.

找出受影響的系統

A list of Nessus plugins to identify vulnerable assets can be found here.

取得更多資訊

• Microsoft Windows Jet Database Engine Out-Of-Bounds Write Remote Code Execution Vulnerability
• Patching, Re-Patching and Meta-Patching the Jet Database Engine RCE (CVE-2018-8423)
• Zero-day exploit (CVE-2018-8453) used in targeted attacks
• Microsoft Edge Remote Code Execution
• Microsoft Fixes Privilege Escalation 0Day Under Active Attack
• Microsoft Patch Tuesday update covers zero-day, 12 critical issues

Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.