February 2019 Patch Tuesday – 74 Vulns, 20 Critical, Exchange 0-day, Adobe Vulns

This month’s Patch Tuesday is very large, with 74 vulns being addressed of which 20 are labeled as critical. Fifteen of these critical vulns are in the Scripting Engine and browsers, with the remainder being GDI+, SharePoint, and DHCP. Microsoft also issued an Advisory for an Exchange 0-day, along with a patch for one of the two reported vulns. Adobe also released updates for Acrobat/Reader, Flash, Coldfusion, and Creative Cloud.

Workstation Patches

Browser, Scripting Engine, and GDI+ patches should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users.

Exchange

In late January, a 0-day exploit was announced for Microsoft Exchange. This exploit uses several known vulnerabilities in both Exchange and Active Directory. Exploitation allows an attacker to escalate their privileges to Domain Admin. Last week, Microsoft posted an advisory regarding this exploit, which gives some ways to mitigate the vulnerabilities. However, two updates were released today (CVE-2019-0686 and CVE-2019-0724) that supercede the suggested mitigation, and should be highly prioritized for any Exchange environments.

SharePoint

The two SharePoint vulns (CVE-2019-0594 and CVE-2019-0604) allow a malicious user to execute code in the context of the SharePoint application pool and the SharePoint server farm account. While the malicious user would need special rights to perform this action, this patch should be treated as high priority for any SharePoint servers.

DHCP

One vulnerability applies to Windows DHCP Server. It is ranked as Critical and can lead to Remote Code Execution. Any attacker who can send packets to a DHCP server can exploit this vulnerability. This patch should be prioritized for any Windows DHCP implementations.

Adobe Patches

Adobe also released patches for Acrobat/Reader, Flash, Coldfusion, and Creative Cloud. The Acrobat/Reader patches addresses 71 CVEs, and should be deployed to any systems running this software.

The Flash patch is ranked as Important and labeled as an Out-of-bounds Read Information Disclosure by Adobe, but Microsoft ranks it Critical and labels it with Remote Code Execution. The CVE (CVE-2019-7090) matches, though the Microsoft bulletin links to a non-existent Adobe bulletin at the time of this writing.

The ColdFusion patch addresses two vulns, with one of them ranked as Critical. This is a Java deserialization vulnerability that should be deployed as soon as possible, as exploitation can lead to remote code execution. Additional steps may be required after deploying the update.