icetray - Fotolia
July Patch Tuesday brings three public disclosures
Microsoft resolved three public disclosures and updated its Spectre and Meltdown advisory this July Patch Tuesday. In total, Microsoft addressed about 54 vulnerabilities.
Microsoft announced three public disclosures from the 54 vulnerabilities released in the July Patch Tuesday.
An elevation of privilege public disclosure (CVE-2018-8313) affects all OSes except Windows 7. Attackers could impersonate processes, cross-process communication or interrupt system functionality to elevate their privilege levels. The patch addresses this issue by ensuring that the Windows kernel API enforces permissions.
"The fact that there is some level of detailed description of how to take advantage of this out in the open, it's a good chance an attacker will look to develop some exploit code around this," said Chris Goettl, director of product management and security at Ivanti, based in South Jordan, Utah.
A similar elevation-of-privilege vulnerability (CVE-2018-8314) this July Patch Tuesday affects all OSes except Windows Server 2016. Attackers could escape a sandbox to elevate their privileges when Windows fails a check. If this vulnerability were exploited in conjunction with another vulnerability, the attacker could run arbitrary code. The update fixes how Windows' file picker handles paths.
A spoofing vulnerability in the Microsoft Edge browser (CVE-2018-8278) tricks users into thinking they are on a legitimate website. The attacker could then extract additional code to remotely exploit the system. The patch fixes how Microsoft Edge handles HTML content.
"That type of enticing of a user, we know works," Goettl said. "It's not a matter of will they get someone to do it or not; it's a matter of statistically you only need to entice so many people before somebody will do it."
Out-of-band updates continue
Chris Goettl
Before July Patch Tuesday, Microsoft announced a new side-channel attack called Lazy FP State Restore (CVE-2018-3665) -- similar to the Spectre and Meltdown vulnerabilities -- on supported versions of Windows. An attacker uses a different side-channel to pull information from other registers on Intel CPUs through speculative execution.
Jimmy Graham
Microsoft also updated its Spectre and Meltdown advisory (ADV180012). It does not contain any new releases on the original three variants, but the company did update the Speculative Store Bypass, Variant 4 of the Spectre and Meltdown vulnerabilities. This completed coverage for Intel processors, and Microsoft is still working with AMD to mitigate its processors.
Microsoft released out-of-band patches between June and July Patch Tuesday for a third-party Oracle Outside In vulnerability (ADV180010) that affects all Exchange servers.
"We don't have a lot of info on the exploitability," said Jimmy Graham, director of product management at Qualys, based in Foster City, Calif. "It should be treated as critical for Exchange servers."
New Windows Server 2008 R2 servicing model on its way
Alongside its June Patch Tuesday, Microsoft announced plans to switch the updating system for Windows Server 2008 SP2 to a rollup model. The new monthly model will more closely match the servicing model used for older Windows versions, enabling administrators to simplify their servicing process. This will include a security-only quality update, a security monthly quality rollup and a preview of the monthly quality rollup.
"The 2008 Server users out there now need to adopt the same strategy, where they had the luxury of being able to do one or two updates if they chose to and not the rest," Goettl said.
The new model will preview on Aug. 21, 2018. Administrators will still receive extended support for Windows Server 2008 SP2 until January 2020. After that, only companies that pay for Premium Assurance will have an additional six years of support.
For more information about the remaining security bulletins for July Patch Tuesday, visit Microsoft's Security Update Guide.
