Back to qualys.com
3 posts

December 2018 Patch Tuesday – 39 Vulns, Workstation Patches, Adobe Vulns

Microsoft and Adobe LogosThis month’s Patch Tuesday addresses 39 vulnerabilities, with 9 of them labeled as Critical. Out of the Criticals, most are browser-related, with the rest including Windows, and .net Framework. A Privilege Escalation vulnerability exists in Windows kernel which has been exploited in wild. Adobe also patched 9 Critical and Important vulnerabilities this month for Adobe Acrobat and Reader.

On the basis of volume and severity this Patch Tuesday is light in weight.

Workstation Patches

Browser and Scripting Engine patches should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users. Out of the 9 vulnerabilities, 6 can be exploited through browsers.

Active Attacks on Win32k Privilege Escalation

Microsoft has reported that there are active attacks detected against CVE-2018-8611. Microsoft has ranked this patch as Important. It is important to prioritize Windows kernel patching.

Adobe Patches and Mitigations

Adobe released nine patches for Acrobat/Reader, with 6 rated as critical and 3 as important. In early December, Adobe also released out-of-band patches for Adobe Flash. CVE-2018-15982 is rated as critical and has been exploited in wild. CVE-2018-15983 is labeled as important.

October 2018 Patch Tuesday – 49 Vulns, Critical browser patches, Hyper-V, Adobe vulns

In this month’s Patch Tuesday release there are 49 vulnerabilities patched with 12 Criticals. Out of the criticals, over half are browser-related, with the rest including Hyper-V and MSXML Parser.  Microsoft Exchange covers CVE-2010-3190 which was not identified as in-scope product when originally published, per Microsoft. Microsoft Office covers 9 Important CVEs including Sharepoint and Graphics component.

Continue reading …

How to detect NTP Amplification DoS Attacks

The ntpd program is an operating system daemon that sets and maintains the system time in synchronization with Internet standard time servers. As described in CVE-2013-5211, a denial of service condition can be caused by the use of the "monlist" feature, which is enabled by default on most NTP servers. NTP runs over UDP port 123, and since it’s on a UDP port, the source address can be spoofed easily.

Continue reading …