Wow can’t believe we are in the middle of February already (tempus fugit), so it’s that time of the month again for Microsoft’s security updates.February 2019’s Patch Tuesday has included approx. 70 vulnerabilities across numerous MS products. Of those listed, 20 of these flaws have been rated as Critical with the ability to fully compromise the vulnerable system. In addition, more than 45 vulns are considered Important, with 3 rated Moderate and 1 rated Low severity.Vulnerable products impacted include the ever-present Chakra scripting engine, MS Edge and Internet Explorer browsers, MS Exchange, and SharePoint 2010.Nine of the 20 Critical vulnerabilities exist in the MS Edge browser and how its Chakra scripting engine handles objects in memory. By directing a user to access a specially crafted web page, these vulnerabilities can be exploited, corrupting the objects in the systems memory and allowing the actor to gain remote access and code execution to the victim’s machine.More memory corruption vulns exist in Internet Explorer, marked as CVE-2019-0606&CVE-2019-0676. While CVE-2019-0606 is like the Edge vulns above, allowing a remote hacker to execute code following access to a specially created website, an actor exploiting CVE-2019-0676 can search and test for specific files located on the victim’s hard disk.CVE-2019-0604 highlights a critical vuln in SharePoint 2010 where it fails to properly check an application package. By successfully exploiting this issue an attacker could use a crafted application package to launch remote code against the target system.The update for CVE-2019-0686 in MS Exchange email server resolves a privilege elevation vuln, where an attacker can gain rights to a machine, allowing access to the mailbox of other users in the organisation. A man-in-the-middle attack can be used to forward authentication requests to the server, allow the attacker gain access by impersonating another user.Please don’t delay, review and get patching as soon as you can!Keeping up to date with security patches for your operating systems and software, is a critical part of delivering and maintaining a strong security posture, please ensure you test and update as quickly as possible to prevent exploitation and stay secure.For a full list of this months updates please see the links below:Patch Tuesday release notes: https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/51503ac5-e6d2-e811-a983-000d3a33c573Security update guide: https://portal.msrc.microsoft.com/en-us/security-guidance
To keep up to date with our news and posts why not join our mailing list by using the link to subscribe: http://bit.ly/IronMailListYou can also follow us using the social media links provided.Ironshare – Security Simplified
Stuart Hare is a Technologist with a passion for helping people in all aspects of IT & Cyber Security. Stuart is the Founder of Ironshare, an Information and Cyber Security company providing consultancy and managed services.
Samuel is a Security Analyst with Ironshare, an Information and Cyber Security company providing Security consultancy and managed services.
Joshua is working as a Managed Service Lead with Ironshare, an Information and Cyber Security company providing Security consultancy and managed services.
