This month Microsoft fixed 50 vulnerabilities in IE/Edge browsers, ChakraCore, Office applications, Hyper-V, Office servers and operating system components. We all have used to vulnerabilities in IE/Edge, usual privilege escalations, Office bugs. Let’s have a closer look at the most interesting and not common ones.

Remote code execution in Microsoft Outlook (CVE-2018-8244)

Microsoft has rated this vulnerability as important. Based on the initial description, if you receive a malicious email with a hidden attachment and accidently click on any link in this email, the attachment gets executed. This bug is ideal for any APT and affects all versions of Microsoft Office.

Two vulnerabilities in HTTP.sys (CVE-2018-8226, CVE-2018-8231)

The vulnerabilities allow remote code execution and remote denial of service. Very dangerous vulnerabilities for Internet facing services, especially CVE-2018-8231 that cal lead to RCE.

Remote code execution in DNSAPI (CVE-2018-8225)

A very rare and dangerous flaw in DNSAPI implementation in all versions of Microsoft Windows. This vulnerability is hard to exploit as the attacker should have the ability to directly interact with the affected system, e.g. send a malicious response to the request. The attacker can perform however a MitM attack to exploit it. Given that the vulnerability leads to remote code execution with Local System Account privileges it should be patched ASAP.

Here are some stats for this patch Tuesday:

As usual, the majority of vulnerabilities are related to buffer errors.

Most of the vulnerabilities can be exploited remotely.

32 vulnerabilities can lead to system compromise.

And here is the complete list of all patches: