Today Microsoft has released security fixes for 60 vulnerabilities in total. Among them 2 zero-days in Windows Shell (CVE-2018-8414) and Internet Explorer (CVE-2018-8373) rated as Critical by our analysts, 26 vulnerabilities have high severity rating, 3 – medium, and 29 are rated low.

43 vulnerabilities can be exploited remotely, 16 locally and one vulnerability in Cortana requires physical access to the affected device.

The majority of weaknesses, as usual, are buffer errors (34), the second place is divided between information exposure and input validation errors (7 for each). 5 vulnerabilities are related to improper permissions management.

Zero-days

Microsoft has patched two vulnerabilities that are being exploited in the wild in limited targeted attacks.

Vulnerability in Windows Shell (CVE-2018-8414) is related to path validation and allows a remote attacker to execute commands via a specially crafted file.

Another zero-day in Internet Explorer (CVE-2018-8373) is a classic memory corruption vulnerability.

So far there are no additional information about real-world attacks that involved these vulnerabilities.

RCE in Exchange again

Another RCE vulnerability was patched this month in Microsoft Exchange. According to vendor, the vulnerability can be exploited with a malicious email message sent to affected system.

The last memory corruption vulnerability in Exchange was patched in May this year.

RCE in LNK files

And yet again good old Windows shortcuts are under investigation. The wormable bugs are described with two CVEs CVE-2018-8345 and CVE-2018-8346 that allow to abuse Windows Explorer autoplay functionality. The vulnerability can be exploited remotely and was rated by our team with high severity rating.

RCE in Microsoft SQL Server

And last but not least – memory corruption in SQL server. The vulnerability by itself requires that the attacker is able to execute SQL query. However, SQL servers are often used as backend for web applications. If you are running a web application that is vulnerability to SQL injection attacks, then exploitation of this bug gets easier.

Below is a summarized table of this patch Tuesday: