Microsoft’s October 2018 Security Update: There's More to the Story

Satnam Narang

A week after Microsoft addressed 49 vulnerabilities in its October 2018 Security Update, new developments have emerged that change the threat profile of some of them.

Background

On Tuesday, October 9, Microsoft released its October 2018 Security Update, also known as Patch Tuesday. This security update contained fixes for 49 vulnerabilities. Since the publication of this security update, new developments have emerged that change the threat profile of some of these vulnerabilities. The most notable developments center around vulnerabilities in Microsoft Windows Shell, Microsoft Win32k.sys and Microsoft JET Database Engine.

Vulnerability details

On September 20, Trend Micro’s Zero Day Initiative (ZDI) published an advisory on CVE-2018-8423, a zero-day vulnerability in Microsoft Windows JET Database Engine. The advisory was published after researchers provided Microsoft with a responsible disclosure timeline of 120 days. Microsoft did release a patch for this vulnerability as part of the October 2018 Security Update. However, researchers from 0patch, a company that produces micropatches for vulnerable software, published a blog on October 12 claiming Microsoft’s patch for the JET Database Engine vulnerability was incomplete. At the time of publication, Microsoft has not responded to 0patch’s claim.

On October 10, Kaspersky Lab researchers published a blog on CVE-2018-8453, a zero-day vulnerability in Win32k.sys that its researchers discovered being exploited in the wild by an Advanced Persistent Threat (APT) group known as FruityArmor. This zero-day is an elevation of privilege vulnerability packaged as part of a malicious software (malware) installer used against less than 12 targets based in the Middle East region. Kaspersky notified Microsoft of this vulnerability in August 2018 and a patch was released as part of the October 2018 Security Update.

On October 11, researcher Abdulrahman Al-Qabandi published a blog around his discovery of a remote code execution vulnerability in Windows Shell, CVE-2018-8495. Al-Qabandi provided these details to the ZDI, which worked with Microsoft to address this issue in the October 2018 Security Update. In his blog, Al-Qabandi provides a Proof of Concept (PoC) revealing how the vulnerability can be exploited. The concern around a PoC being made available is that it provides malicious actors a blueprint to leverage this vulnerability to attack users in the wild.

Urgently required actions

Despite the claim that the patch for the JET Engine Database vulnerability is incomplete, customers are still advised to apply Microsoft’s October 2018 Security Update to all assets. Applying this update will address 49 CVEs, including the Win32k.sys and Windows Shell vulnerabilities.

It is unclear whether or not Microsoft will provide clarification about the claim made about the JET Engine Database vulnerability prior to the November 2018 Security Update. Until then, customers are advised to restrict interaction with vulnerable applications to trusted files.

While applying security updates and patches is vital, patching alone is just one part of a larger picture in securing assets. These developments underscore the importance of comprehensive security that encompasses having visibility into your assets, contextualizing potential risks to prioritize responses and taking action to close the Cyber Exposure gap.

Identifying affected systems

A list of Nessus plugins to identify vulnerable assets can be found here.

Get more information

Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.

Read more >

Published on Oct 15, 2018

People also viewed

Technical Support Engineer

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Technical Support Technical Support
Your Role:Tenable is looking for motivated individuals to join our Technical Support Team. The Technical Support Engineer (TSE) is the first contact for all customers when they require technical assistance.  In a time when the next Spectre and Mel...

Customer Success Manager - APAC Nessus

Singapore Singapore Singapore North Bridge Road, Parkview Square, Singapore, 188788 Customer Success Sales
Your Role:Tenable has an immediate need for a Customer Success Manager who will be responsible for establishing and driving sales activities for our software products within a designated geography. You will be expected to penetrate and prospect na...

Sales Development Representative

Singapore Singapore Singapore North Bridge Road, Parkview Square, Singapore, 188788 Lead Generation Sales
Your Role:The Sales Development Representative supports remote sales teams in and is responsible for generating new business via inbound and outbound phone opportunity qualification. Your Opportunity: Perform outbound calling to generate new sales...

Security Engineer - Mexico

Mexico City Mexico Mexico Presidenta Masarik, Polanco V Seccion, Mexico City, Mexico, 21045 Sales Engineering Sales
Your Role:Tenable is seeking a Security Engineer to support demos and evaluations of enterprise opportunities across the territory. Assist in developing business value propositions around Tenable's products and solutions. Drives sales with technic...

Director of Engineering - Shared Services Infrastructure

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Sensors Engineering
Your Role:Tenable is looking for a talented and energetic Director of Software Engineering to lead the Shared Services Infrastructure (SSI) development team. The SSI team helps organizations address key challenges of traditional vulnerability scan...

Principal UX Designer

San Jose California United States E Santa Clara St., San Jose, California, United States, 95113 Cloud Platforms Engineering
Your Role:Tenable is looking for an extraordinary Principal UX Designer to join our team. Our group is chartered with creating the next generation of security products while at the same time pioneering unprecedented user experience in the digital ...

We have big plans for continued global growth, and we’re looking for people who are creative, flexible and dedicated to helping us build something great – something that matters.