June 2018 Patch Tuesday – New Speculative Store Bypass Fixes, Adobe Vulns

June’s Patch Tuesday is lighter weight compared to previous months.  In all, 51 unique CVEs are addressed, with 11 CVEs marked as Critical. Adobe also released an out-of-band update for a Flash Player vulnerability last week, which is being actively exploited.

Speculative Store Bypass

Microsoft released patches for Speculative Store Bypass, also known as Spectre Variant 4. These patches enable Speculative Store Bypass Disable (SSBD) for Intel processors. New Intel microcode will be required to be fully protected against Variant 4. Microsoft has released an article with recommended actions.

Windows DNSAPI

Patches were released for vulnerabilities in the Windows DNSAPI. This could allow an attacker to compromise a system through a malicious DNS server. Mobile workstations that may connect to untrusted wifi are at high risk and this patch should be a priority for them.

HTTP Protocol

A critical flaw in Microsoft’s HTTP.sys is also fixed in this release. HTTP.sys is a kernel-mode protocol listener that is used by IIS and various services in Windows. An attacker exploiting this vulnerability could obtain full control of an impacted system. This patch should be prioritized for all Windows systems, servers and desktops.

Browsers and Scripting Engine

The other critical Microsoft patches are primarily for browsers, the Windows Scripting Engine, and Windows Media Foundation. These patches should be prioritized for workstation-type devices.

Adobe

Adobe released an out-of-band update for a Flash Player vulnerability last week. This vulnerability is being actively exploited according to Adobe, and should be prioritized for workstation-type devices. In May, another out-of-band update was released for Adobe Reader, which also has a publicly available exploit. This patch should also be prioritized for impacted workstations.