Date:13/06/19
Microsoft’s June Patch Tuesday release covered 88 CVE, including 22 rated as critical and four that covered previously announced zero-day vulnerabilities.
The zero-day issues, all are elevation of privilege issues, were tagged as top priority patches of the month by several cybersecurity executives, although the good news is none of the zero days, or other vulnerabilities, were found to be in the wild. These are:
CVE-2019-1069 affects Windows Task Scheduler which could affecting Windows 10, Server 2016 and later versions.
CVE-2019-1064 is in Windows affecting Windows 10, Server 2016 and later.
CVE-2019-1053 is a vulnerability in Windows Shell and affects all currently supported Windows operating systems.
CVE-2019-0973 is a vulnerability in Windows Installer.
"Public Disclosure is an indicator or increased risk. Before the update was made available information about the vulnerability including possible proof of concept code has already been released to the general public. This means attackers have had early access to engineer an exploit to take advantage of these vulnerabilities," said Chris Goettl, director of product management, Security, Ivanti
Satnam Narang, senior research engineer for Tenable, agreed the four zero day vulnerabilities required quick attention, but also called out CVE-2019-0888.
"The highest rated CVE in this month’s release is CVE-2019-0888, a vulnerability in the way ActiveX Data Objects (ADO) handles objects in memory. This could be exploited by an attacker to convince a user to visit a malicious website, resulting in arbitrary code execution as the current user," he said.
Jimmy Graham, senior director of product management, at Qualys, pointed out three issued in Hyper-V Hypervisor Escape for attention.
"Three remote code execution vulnerabilities (CVE-2019-0620, CVE-2019-0709, and CVE-2019-0722) are patched in Hyper-V that would allow an authenticated user on a guest system to run arbitrary code on the host system. Microsoft notes that exploitation of this vulnerability is less likely, but these patches should still be prioritised for Hyper-V systems," he said.
Microsoft patches 22 critical flaws, four zero days on June Patch Tuesday
Microsoft’s June Patch Tuesday release covered 88 CVE, including 22 rated as critical and four that covered previously announced zero-day vulnerabilities.The zero-day issues, all are elevation of privilege issues, were tagged as top priority patches of the month by several cybersecurity executives, although the good news is none of the zero days, or other vulnerabilities, were found to be in the wild. These are:
CVE-2019-1069 affects Windows Task Scheduler which could affecting Windows 10, Server 2016 and later versions.
CVE-2019-1064 is in Windows affecting Windows 10, Server 2016 and later.
CVE-2019-1053 is a vulnerability in Windows Shell and affects all currently supported Windows operating systems.
CVE-2019-0973 is a vulnerability in Windows Installer.
"Public Disclosure is an indicator or increased risk. Before the update was made available information about the vulnerability including possible proof of concept code has already been released to the general public. This means attackers have had early access to engineer an exploit to take advantage of these vulnerabilities," said Chris Goettl, director of product management, Security, Ivanti
Satnam Narang, senior research engineer for Tenable, agreed the four zero day vulnerabilities required quick attention, but also called out CVE-2019-0888.
"The highest rated CVE in this month’s release is CVE-2019-0888, a vulnerability in the way ActiveX Data Objects (ADO) handles objects in memory. This could be exploited by an attacker to convince a user to visit a malicious website, resulting in arbitrary code execution as the current user," he said.
Jimmy Graham, senior director of product management, at Qualys, pointed out three issued in Hyper-V Hypervisor Escape for attention.
"Three remote code execution vulnerabilities (CVE-2019-0620, CVE-2019-0709, and CVE-2019-0722) are patched in Hyper-V that would allow an authenticated user on a guest system to run arbitrary code on the host system. Microsoft notes that exploitation of this vulnerability is less likely, but these patches should still be prioritised for Hyper-V systems," he said.
Views: 403
©ictnews.az. All rights reserved.
Similar news
- Cellphone Use May Raise Cancer Risk
- Australian police pushes cyber safety education
- Vietnam aims to lead in e-government
- Senate Website Gets Hacked
- US builds net for cyber war games
- Japan enacts anti-computer virus law
- India passes law vs e-waste
- Anonymous Declares War On The City Of Orlando
- Microsoft highlights evolving dangers as online identity data proliferates
- Consumers want internet security to be provided by banks
- Government facilities targets of cyber attack
- South Korean web attacks might been war drill
- Sri Lanka to Establish National Passport Database to Increase Border Security
- Hi-tech crime agencies set to employ information security professionals
- Phone hacking and online campaign bring down the News of the World
