Interesting vulnerabilities in Microsoft products happen not that often. This time however we have patches for TWO zero-days in Windows and RCE in Microsoft Exchange. Something not very usual.

Zero-days

The first zero day was reported in April by 360 Core Security as vulnerability in Internet Explorer and was dubbed “double play” due to specific exploitation vector. According to new information, the bug resides within Microsoft VBScript engine and affects all supported Microsoft Windows operating systems.

The second zero-day vulnerability resides within win32k.sys driver and affects Windows 7 and Windows 2008/2008 R2 systems. Currently there isn’t much information about it apart that is seems ESET was the one who reported it.

Last year Microsoft patched 19 zero-days in their products. This year there are just 3 for Microsoft out of 10 in total.

RCE in Microsoft Exchange

Along with 3 XSS in OWA frontend Microsoft also fixed two memory corruption vulnerabilities in Microsoft Exchange engine: out-of-bounds read and buffer overflow. While the first vulnerability grants access to system memory, the second one may allow remote code execution and affects all supported versions of Microsoft Exchange. Both vulnerabilities can be exploited just by sending a specially crafted email message.

Attention: patch your Exchange server ASAP.

Office vulnerabilities

This month Microsoft fixed 10 vulnerabilities in Office applications. Most of them allow remote code execution.

Windows kernel

Along with other bugs vendor released coordinated patch for vulnerability CVE-2018-8897. This vulnerability exists due to faulty implementation of Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) and affects multiple operating systems.

Some numbers

Vulnerabilities distribution by types

Diag. 1

As you can see, most of vulnerabilities are buffer-related errors (CWE-119, CWE-125).

Exploitation vector

Diag. 2

72% of all vulnerabilities are remotely exploitable.

Vulnerabilities by severity

Diag. 3

49% of all vulnerabilities have high or critical severity level, which means that they allow remote code execution.

Here is the list of all patches released during this patch Tuesday: