VERT Threat Alert: January 2019 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s January 2019 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-812 on Wednesday, January 9th. 

In-The-Wild & Disclosed CVEs

CVE-2019-0579

The Windows Jet Database Engine improperly handles objects in memory and, if an attacker can convince a victim to open a malicious file, exploitation of this vulnerability could lead to code execution. Microsoft has rated this as a 3 on the Exploitability Index (Exploitation Unlikely).

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis.  

Tag	CVE Count	CVEs
Windows Hyper-V	2	CVE-2019-0550, CVE-2019-0551
Microsoft Edge	2	CVE-2019-0565, CVE-2019-0566
Windows Subsystem for Linux	11	CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584
ASP.NET	2	CVE-2019-0548, CVE-2019-0564
Microsoft Windows	6	CVE-2019-0543, CVE-2019-0570, CVE-2019-0571, CVE-2019-0572, CVE-2019-0573, CVE-2019-0574
.NET Framework	1	CVE-2019-0545
Windows COM	1	CVE-2019-0552
Visual Studio	2	CVE-2019-0537, CVE-2019-0546
Windows Kernel	4	CVE-2019-0536, CVE-2019-0549, CVE-2019-0554, CVE-2019-0569
Windows DHCP Client	1	CVE-2019-0547
Microsoft Exchange Server	2	CVE-2019-0586, CVE-2019-0588
Internet Explorer	1	CVE-2019-0541
Microsoft XML	1	CVE-2019-0555
Android App	1	CVE-2019-0622
Microsoft Office	4	CVE-2019-0585, CVE-2019-0559, CVE-2019-0560, CVE-2019-0561
Microsoft Scripting Engine	3	CVE-2019-0539, CVE-2019-0567, CVE-2019-0568
Microsoft Office SharePoint	4	CVE-2019-0556, CVE-2019-0557, CVE-2019-0558, CVE-2019-0562

 

Other Information

In addition to the Microsoft vulnerabilities included in the January Security Guidance, a pair of Adobe bulletins are available today.

January 2019 Adobe Flash Update [ADV190001]

Microsoft released an update for Adobe Flash. This corresponds with Adobe Update APSB19-01. This is a non-security update and includes no new CVEs.

Security Bulletin for Adobe Acrobat and Reader [APSB19-02]

Adobe has released security updates for Adobe Acrobat and Reader. This includes fixes for 2 CVEs: CVE-2018-16011 and CVE-2018-16-18.