As businesses brace for vulnerabilities in their systems, Microsoft has announced the release of critical security patches during the May 2018 Patch Tuesday. This update addresses a staggering 67 security vulnerabilities, including two zero-day exploits under active attack by cybercriminals, a situation that demands immediate attention from organizations across various sectors.
The vulnerabilities patched relate to an array of Microsoft products including Windows operating systems, Internet Explorer, Microsoft Edge, and Microsoft Office applications, among others. Out of the total vulnerabilities, 21 have been classified as critical, while 42 are rated important and 4 deemed low severity. The implications of these vulnerabilities could affect both individual users and enterprises.
Of particular importance is a zero-day vulnerability identified as CVE-2018-8174, referred to by security researchers as “Double Kill.” This critical remote code execution flaw, disclosed by Qihoo 360, impacts all supported versions of Windows. Threat actors can exploit this vulnerability through various methods, including compromised websites and malicious Office documents, allowing them to execute arbitrary code with the privileges of the logged-in user. Microsoft has emphasized the need for urgency, stating that administrative users are particularly at risk, as attackers could gain full control over the affected systems.
Another significant vulnerability, CVE-2018-8120, pertains to privilege escalation within the Win32k component of Windows. This flaw affects Windows 7 and Windows Server 2008 editions. By exploiting this vulnerability, an attacker could easily execute arbitrary code in kernel mode, potentially leading to the installation of malware or unauthorized access to sensitive data. Microsoft has noted that this vulnerability has already seen active exploitation by malicious actors, although specifics regarding the threat groups involved remain undisclosed.
Additionally, two vulnerabilities that have already been publicly disclosed—one related to the Windows kernel and another tied to image processing—have been patched as part of this round of updates. Microsoft’s comprehensive update also includes fixes for several critical issues such as memory corruption defects in both Edge and the Internet Explorer scripting engine, as well as various remote code execution vulnerabilities impacting Hyper-V.
As this situation unfolds, it’s crucial for businesses to implement security updates without delay to shield themselves from these active threats. IT departments are advised to navigate to the Settings menu, locate the Update & Security option, and check for any available updates to ensure systems are secured against these vulnerabilities.
Importantly, the nature of these vulnerabilities aligns with tactics outlined in the MITRE ATT&CK Matrix. The initial access tactic embodied by the Double Kill vulnerability indicates methods such as phishing or the use of malicious documents, while the privilege escalation tactic seen in CVE-2018-8120 highlights risks associated with local system elevation exploiting flaws in memory handling.
In conclusion, as cyber threats grow more sophisticated, vigilance remains imperative. Business owners must take proactive steps to ensure their defenses are fortified, thereby safeguarding sensitive business data and maintaining the integrity of their technological environment. Now more than ever, the implementation of timely security updates is paramount to protect organizational assets against emerging cyber threats.
