Category: Microsoft|Sep 16, 2019 | Author: Admin

Microsoft September Patch Tuesday Addresses Two Actively Exploited Zero-Day Bugs

Share on

This Tuesday, Microsoft has rolled-out its scheduled monthly updates for 80 different bugs. Notably, the September Patch Tuesday update bundle from Microsoft brings fixes for two zero-day bugs under active exploit.

Patches For Actively Exploited Zero-Day Vulnerabilities The most noteworthy fixes in Microsoft September Patch Tuesday bundle includes ones for two zero-day bugs under active exploit. These two zero-days precisely are privilege escalation bugs. While both of these attained important severity rating, they became a problem owing to their active exploitation in the wild. The first of these is an EoP in the Windows Common Log File System Driver (CVE-2019-1214). The bug existed due to improper object handling in the memory by Windows CLFS. Upon an exploit, the flaw could let an attacker execute processes with elevated user privileges. Regarding the exploit condition, Microsoft stated in their advisory,

To exploit the vulnerability, an attacker would first have to log on to the system, and then run a specially crafted application to take control of the affected system.

Whereas, the other EoP existed in the ws2ifsl.sys (Winsock) owing to improper object handling in memory. Regarding this Windows vulnerability (CVE-2019-1215), Microsoft explained in the advisory,

An attacker who successfully exploited the vulnerability could execute code with elevated privileges. To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.

Other Microsoft September Patch Tuesday Updates Apart from the two zero-days, Microsoft has also patched 79 other bugs with this update bundle. These include 17 critical vulnerabilities that could allow remote code execution upon an exploit. Of these, 4 existed in the Remote Desktop Client, 5 in the Chakra Scripting Engine, 2 in VBScript, 3 in Microsoft SharePoint, and 1 RCE bug each in Scripting Engine, .LNK file processing, and Azure DevOps Server (ADO) and Team Foundation Server (TFS). Microsoft also fixed 60 other important severity bugs in various products. These bugs, upon exploit, could result in information disclosure, spoofing, the elevation of privileges, or even remote code execution. In addition, Microsoft also patched a moderate severity spoofing vulnerability (CVE-2019-1259), in Microsoft SharePoint. In August, Microsoft addressed 93 vulnerabilities with its Patch Tuesday bundle, more than the ones addressed this month. However, the previous month’s patches did not include any actively exploited bugs. Make sure to update your systems at the earliest to stay protected from potential attacks.

Sponsored Ads:

Comments:


Had to crisis-postpone new 5G standard in the US to avoid plane chaos

Category: IT|Jan 20, 2022 | Author: Admin

No one found out that the iPhone 13 is missing this until now

Category: Apple|Jan 19, 2022 | Author: Admin

Safari leaks your browser history

Category: General|Jan 18, 2022 | Author: Admin

Chromium Trouble - Can't change default search engine anymore

Category: Google|Jan 17, 2022 | Author: Admin

Here, developers are allowed by Apple to offer alternative payment methods

Category: Apple|Jan 16, 2022 | Author: Admin

Microsoft refuses to correct the error - took matters into its own hands

Category: Microsoft|Jan 15, 2022 | Author: Admin

Now Meta gets the authorities on its neck, again

Category: General|Jan 14, 2022 | Author: Admin

Has invested heavily in podcasts - now Spotify is closing down the studio

Category: General|Jan 13, 2022 | Author: Admin

Claims HomePod mini is on its way to Norway

Category: General|Jan 12, 2022 | Author: Admin

Linux gets the function everyone wants

Category: IT|Jan 11, 2022 | Author: Admin

Flasher RTX 3080 Ti with 3090 BIOS for extra efficient Ethereum mining

Category: General|Jan 10, 2022 | Author: Admin

Dice continues to destroy for himself: removed favorite from Battlefield 2042

Category: General|Jan 9, 2022 | Author: Admin

NBN Co applies fix to get hundreds of Sky Muster satellite services back online

Category: IT|Jan 8, 2022 | Author: Admin

You can trick Windows 11's new media player

Category: Microsoft|Jan 7, 2022 | Author: Admin

Intel Core i9 is faster than M1 Max

Category: General|Jan 6, 2022 | Author: Admin
more