[Hacker News]Latest Microsoft Update Patches New Windows 0-Day Under Active Attack

 o 참고사이트
- 한글 : https://portal.msrc.microsoft.com/ko-kr/security-guidance
- 영문 : https://portal.msrc.microsoft.com/en-us/security-guidance

https://portal.msrc.microsoft.com/ko-kr/security-guidance

Source for https://thehackernews.com/2019/12/windows-zero-day-patch.html

Latest Microsoft Update Patches New Windows 0-Day Under Active Attack

With its latest and last Patch Tuesday for 2019, Microsoft is warning billions of its users of a new Windows zero-day vulnerability that attackers are actively exploiting in the wild in combination with a Chrome exploit to take remote control over vulnerable computers.

Microsoft's December security updates include patches for a total of 36 vulnerabilities, where 7 are critical, 27 important, 1 moderate, and one is low in severity—brief information on which you can find later in this article.

Tracked as CVE-2019-1458 and rated as Important, the newly patched zero-day Win32k privilege escalation vulnerability, reported by Kaspersky, was used in Operation WizardOpium attacks to gain higher privileges on targeted systems by escaping the Chrome sandbox.

Although Google addressed the flaw in Chrome 78.0.3904.87 with the release of an emergency update last month after Kaspersky disclosed it to the tech giant, hackers are still targeting users who are using vulnerable versions of the browser.

As The Hacker News reported last month, Operation WizardOpium involved a compromised Korean-language news portal where attackers secretly planted a then-zero-day Chrome exploit to hack computers of its visitors.

According to Kaspersky researchers, the Chrome use-after-free exploit was chained together with the newly patched EoP flaw that exists in the way the Win32k component in Windows OS handles objects in memory.

Windows 0-day exploit CVE-2019-1458 used in Operation WizardOpium

The EoP exploit works on "the latest versions of Windows 7 and even on a few builds of Windows 10" and, if successfully exploited, could allow an attacker to run arbitrary code in kernel mode.

While the researchers were not able to attribute the Operation WizardOpium attacks to any specific group of hackers, they found some similarities in the exploit code with the infamous Lazarus hacking group.

Microsoft Patch Tuesday: December 2019

The 7 critical security vulnerabilities Microsoft patched this month affect Git for Visual Studio, Hyper-V Hypervisor, and Win32k Graphics component of Windows, successful exploitation of all lead to remote code execution attacks.

The Windows Hyper-V vulnerability (CVE-2019-1471) enables a guest virtual machine to compromise the hypervisor, escaping from a guest virtual machine to the host, or escaping from one guest virtual machine to another guest virtual machine.

Git for Visual Studio contains five critical remote code execution vulnerabilities—all reside due to the way Git for Visual Studio sanitizes input—successful exploitation of which requires attackers to convince a targeted user to clone a malicious repo.

Another notable vulnerability, tracked as CVE-2019-1462 and rated as important, resides in the PowerPoint software that can be exploited to run arbitrary code on a targeted computer by merely convincing the victim into opening a specially crafted presentation file.

This vulnerability affects Microsoft PowerPoint 2010, 2013, and 2016 as well as Microsoft Office 2016 and 2019 for Windows and Apple's macOS operating systems.

Other vulnerabilities patched by Microsoft this month and marked as important reside in the following Microsoft products and services:

• Windows Operating System
• Windows Kernel
• Windows Remote Desktop Protocol (RDP)
• Microsoft Word
• Microsoft Excel
• Microsoft SQL Server Reporting Services
• Microsoft Access software
• Windows GDI component
• Win32k
• Windows Hyper-V
• Windows Printer Service
• Windows COM Server
• Windows Media Player
• Windows OLE
• VBScript
• Visual Studio Live Share
• Microsoft Authentication Library for Android
• Microsoft Defender
• Skype for Business and Lync
• Git for Visual Studio

Most of these vulnerabilities allow information disclosure and elevation of privilege, and some also lead to remote code execution attacks, while others allow cross-site scripting (XSS), security feature bypass, spoofing, tampering, and denial of service attacks.

Windows users and system administrators are highly advised to apply the latest security patches as soon as possible in an attempt to keep cybercriminals and hackers away from taking control of their computers.

For installing the latest Windows security updates, you can head on to Settings → Update & Security → Windows Update → Check for updates on your PC, or you can install the updates manually.