December Patch Tuesday: Vulnerabilities in Windows components, RDP, and PowerPoint Get Fixes

Microsoft released a total of 36 patches for December’s Patch Tuesday. Decembers tend to have a relatively low number of patches, and the last Patch Tuesday of the 2010s was no different. Seven of the 36 patches were identified as Critical, 28 Important, and one Moderate. The vulnerabilities covered a wide variety of Microsoft products, including Windows, Internet Explorer, Office, Hyper-V Server, and SQL Server. None of the fixed vulnerabilities were disclosed to the public before patching, although one was under active attack at the time of the patch.

Here’s a more detailed look at the notable vulnerabilities that have been patched in December:

XSS vulnerability in SQL Server Report Manager

CVE-2019-1332 is a cross-site scripting (XSS) vulnerability in SQL Server Report Manager. If successfully abused, an attacker could steal web cookies, hijack web sessions. This vulnerability can also potentially allow unauthorized access to the affected computer.

Remote Desktop Protocol vulnerability

CVE-2019-1453, a denial of service vulnerability in Remote Desktop Protocol (RDP), is triggered when an attacker connects to the target system using RDP and sends specially crafted requests. Upon successful execution, an attacker could cause the RDP service on the target system to stop responding.

RCE vulnerability in PowerPoint

CVE-2019-1462 is an RCE vulnerability that can let an attacker run arbitrary code in the context of the current user. A current user logged on with administrative user rights can allow an attacker to take control of the affected system.

Windows component vulnerabilities

Several vulnerabilities were found in key Windows components, including two flaws in Hyper-V Server: CVE-2019-1471, a remote code execution (RCE) vulnerability, and CVE-2019-1470, an information disclosure vulnerability.

CVE-2019-1471 can be abused when an attacker runs a specially crafted application on a guest operating system (OS), which could allow arbitrary code execution on the affected system. Meanwhile, CVE-2019-1470 can allow an attacker to gain access to information on the Hyper-V host OS.

Trend Micro solutions

Users with affected installations are advised to prioritize the updates in order to avoid possible system exploitation through unpatched vulnerabilities. The Trend Micro Deep Security and Vulnerability Protection solutions also protect systems and users from threats targeting the vulnerabilities included in this month’s Patch Tuesday, updating or creating rules to address applicable vulnerabilities found. The following rules have been released to cover the appropriate vulnerabilities:

• 1010083-Microsoft Windows Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-0617)
• 1010084-Microsoft Windows Jet Database Engine Multiple Remote Code Execution Vulnerabilities (Jan-2019)
• 1010085-Microsoft Internet Explorer VBScript Remote Code Execution Vulnerability (CVE-2019-1485)
• 1010086-Microsoft GDI+ Remote Code Execution Vulnerability (CVE-2019-0853)
• 1010087-Microsoft Windows Elevation of Privilege Vulnerability (CVE-2019-1458)
• 1010088-Microsoft Windows GDI Information Disclosure Vulnerability (CVE-2019-1439)
• 1010089-Microsoft Windows Graphics Multiple Remote Code Execution Vulnerabilities (Aug-2019)
• 1010090-Microsoft Windows DirectWrite Remote Code Execution Vulnerability (CVE-2019-1117 and CVE-2019-1118)
• 1010091-Microsoft Windows DirectWrite Remote Code Execution Vulnerability (CVE-2019-1119)
• 1010092-Microsoft Windows Common Log File System Driver Elevation Of Privilege Vulnerability (CVE-2019-0959)
• 1010093-Microsoft Windows Graphics Remote Code Execution Vulnerability (CVE-2019-1150)

Trend Micro TippingPoint® customers are protected from threats and attacks that may exploit some of the vulnerabilities fixed this month via the following MainlineDV filters:

• 36787: HTTP: Microsoft Windows User-Mode Privilege Escalation Vulnerability
• 36779: HTTP: Microsoft Internet Explorer VBScript Filter Use-After-Free Vulnerability

The post December Patch Tuesday: Vulnerabilities in Windows components, RDP, and PowerPoint Get Fixes appeared first on .