May Patch Bulletin

May Patch Bulletin

This month there are 80 unique Microsoft related CVE’s, 1 public and exploited, 1 publicly disclosed, and 17 technologies affected. We pay close attention to:

•  CVE-2019-0863 (This is an elevation of privilege vulnerability caused by the way Windows Error Reporting handles files.  An attacker would have to be able to run code on the system as a standard user in order to exploit this vulnerability) and CVE-2019-0708 (does has not been disclosed or exploited but could be very impactful to organizations if it were to be exploited.  This vulnerability could be exploited remotely using RDP.  Let’s hope, just after the 2 year anniversary of the WannaCry ransomware outbreak, that we do not have a WannaCry 2 outbreak).
• CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability – An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with administrator privileges. To exploit the vulnerability, an attacker must first gain unprivileged execution on a victim system. The security update addresses the vulnerability by correcting the way WER handles files.
• CVE-2019-0708 | A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP. The update addresses the vulnerability by correcting how Remote Desktop Services handles connection requests. Considering the criticality of the situation that might follow, updates were also released for Windows XP and Windows Server 2003 which are no longer supported by Microsoft.

For additional details, please find the information from Microsoft below:

In case of any questions or clarifications please feel free to reach out to ECHO’s Service Desk.