Introduction
Our February blog provided a detailed review as to the background of the Microsoft Patch Tuesday, and what it means for both business entities and individuals. In that blog, we also reviewed what some of the critical patches were for that month, and also provided the links to learn more about and where to download them.
In this week’s blog, we continue with this theme but now focus upon those for March.
The Vulnerability Categories
Before going into detail about the patches and upgrades, it is important to get an understanding of the categories in which they fall. They are as follows:
- Windows Hyper-V;
- Team Foundation Server;
- Skype for Business;
- Jet Database Engine;
- Visual Studio;
- Windows 10 Operating System;
- ChakraCore
- Microsoft Office;
- Internet Explorer;
- Microsoft Edge.
The Specific Patches/Upgrades
The following matrix reviews some of the patches and upgrades for March, starting with the ones that are deemed to be “Critical”.
Microsoft Rating Reference Number Description
|
Critical |
|
This affects the Chakra Scripting Engine, and how it handles objects in memory with Microsoft Edge. A Cyber attacker can easily execute arbitrary code. |
|
Critical |
|
This is another remote execution code vulnerability, but it impacts the other web browsers from Microsoft (such as Internet Explorer). A Cyber attacker could very easily embed an Active X Control entitled “Safe For Initialization”. |
|
Critical |
|
This is another remote execution code vulnerability but dealing with the ChakraCore Scripting Engine. If a Cyber attacker gains administrative rights and privileges, they could easily take control, install malicious payloads, alter/delete data, and create phony end-user accounts with full administrative rights. |
|
Critical |
|
This is another remote execution code vulnerability, but dealing with the VBScript Engine, and how it handles objects in memory. A Cyber attacker can potentially a threat vector against a Web-based application, by creating a phony website to further exploit the vulnerabilities that are found in the Internet Explorer web browser. Also, the Cyberattacker can deploy specially crafted Malware behind the content of any given website in order to further exploit this particular vulnerability. |
|
Critical |
|
This is another remote execution code vulnerability, dealing once again with the dealing with the VBScript Engine. Through the vulnerability, the Cyber attacker can create a spoofed website to take full advantage of this vulnerability and attempt an end user to view the phony website. |
|
Critical |
|
This is another remote execution code vulnerability but has its impacts upon the Internet Explorer web browser. Through this vulnerability, a Cyber attacker can very easily insert any arbitrary Source Code and also inject malicious Active X Controls. |
|
Critical |
|
This is another remote execution code vulnerability, affecting the Internet Explorer Web Browser, and how it handles objects that are based in memory. A Cyber attacker can also create a spoofed website through this vulnerability but would have to send a Phishing based E-Mail or Instant Message to the end user in order to get them to view it. |
|
Critical |
|
This is a remote execution vulnerability, but this time it affects the Edge Web Browser from Microsoft. A Cyber attacker could very easily corrupt the memory so that arbitrary lines of Source Code can be executed easily. If the Cyber attacker gains full administrative rights, then they can take complete of an affected system, and gain access to all information and data. |
|
Critical |
|
This is another remote execution vulnerability impacting the Edge Web Browser. Through this vulnerability, a Cyber attacker can easily take full control of websites that have insecure lines of Source Code running behind them. |
|
Critical |
|
This is another remote execution vulnerability which adversely affects the Edge Web Browser and the way it handles objects in memory. It can be very easily corrupt the memory, and arbitrary lines of Source Code can be quickly injected. Through this weakness, a Cyber attacker can very easily gain full administrative rights and permissions. |
|
Critical |
|
This is the final remote execution code vulnerability that has a negative impact upon the Edge Web Browser. Once again, a Cyber attacker, through this particular vulnerability, can create an deploy a spoofed website in order to further exploit this weakness, and from there, entice an end user to view the website. |
Conclusions
Overall, this has examined in detail a bulk of the vulnerabilities that been deemed to be of a “Critical” nature by Microsoft. This is not an all-inclusive list, there are some other vulnerabilities that have been designated as “Critical”, which are as follows:
- Windows Client DHCP Remote Code Execution;
- Microsoft XML Remote Code Execution;
- Windows ActiveX Remote Code Execution;
- Windows Deployment Services TFTP Server;
It is imperative for a business or corporation to install and deploy these software patches immediately because as it appears, a Cyber attacker can very easily inject malicious and arbitrary lines of Source Code that can impact the objects in memory, and even gain full administrative rights. With the latter, the Cyber attacker can also very easily gain full administrative rights and privileges, and quickly delete, alter, and modify mission-critical information and data.
Microsoft's summary of the March 2019 releases can be found here:
https://portal.msrc.microsoft.com/en-us/security-guidance