VERT Threat Alert: July 2018 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s July 2018 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-786 on Wednesday, July 11th.

In-The-Wild & Disclosed CVEs

CVE-2018-8278

Microsoft Edge is vulnerable to a spoofing vulnerability that could allow an attacker to design a malicious fake website that appears to be legitimate. This is due to how Microsoft Edge handles HTML content. Microsoft has rated this as a 1 on the Exploitability Index (Exploitation More Likely).

CVE-2018-8313

A privilege escalation within the Windows Kernel API could allow attackers to impersonate processes, interject cross-process communication, or interrupt system functionality. This attack requires that an authenticated, local user run a purpose-built application. Changes were made to how the Windows Kernel API enforces permissions to resolve this vulnerability. Microsoft has rated this as a 1 on the Exploitability Index (Exploitation More Likely).

CVE-2018-8314

Attackers can escalate privileges and escape a sandbox due to failure in how Windows file picker handles paths. This could allow an attacker to gain higher levels of access but does not specifically allow code execution, attackers would need to pair this attack with another vulnerability if code execution is the desired goal. Microsoft has rated this as a 1 on the Exploitability Index (Exploitation More Likely) for older software releases (the latest software release is not affected).

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis.

Tag	CVE Count	CVEs
Microsoft WordPad	1	CVE-2018-8307
Active Directory	1	CVE-2018-8326
ASP.NET	1	CVE-2018-8171
Microsoft Windows	6	CVE-2018-8206, CVE-2018-8313, CVE-2018-8319, CVE-2018-8305, CVE-2018-8308, CVE-2018-8309
Microsoft PowerShell	1	CVE-2018-8327
Microsoft Devices	1	CVE-2018-8306
.NET Framework	4	CVE-2018-8202, CVE-2018-8356, CVE-2018-8260, CVE-2018-8284
Microsoft Edge	8	CVE-2018-8262, CVE-2018-8274, CVE-2018-8278, CVE-2018-8289, CVE-2018-8297, CVE-2018-8301, CVE-2018-8324, CVE-2018-8325
Device Guard	1	CVE-2018-8222
Visual Studio	2	CVE-2018-8172, CVE-2018-8232
Windows Kernel	1	CVE-2018-8282
Windows Shell	1	CVE-2018-8314
Skype for Business and Microsoft Lync	2	CVE-2018-8238, CVE-2018-8311
Internet Explorer	1	CVE-2018-0949
Microsoft Windows DNS	1	CVE-2018-8304
Microsoft Office	6	CVE-2018-8281, CVE-2018-8323, CVE-2018-8299, CVE-2018-8300, CVE-2018-8310, CVE-2018-8312
Microsoft Scripting Engine	15	CVE-2018-8242, CVE-2018-8275, CVE-2018-8276, CVE-2018-8279, CVE-2018-8280, CVE-2018-8283, CVE-2018-8286, CVE-2018-8287, CVE-2018-8288, CVE-2018-8290, CVE-2018-8291, CVE-2018-8294, CVE-2018-8296, CVE-2018-8298, CVE-2018-8125

 

Other Information

In addition to the Microsoft vulnerabilities included in the July Security Guidance, a security advisory was also made available.

July 2018 Adobe Flash Security Update [ADV180017]

Microsoft released updates for Adobe Flash. These correspond with Adobe Update APSB18-24. This includes fixes for CVE-2018-5007, CVE-2018-5008.