Microsoft Patch Tuesday – December 2019

This month the vendor has patched 36 vulnerabilities, 7 of which are rated Critical.

As always, customers are advised to follow these security best practices:

• Install vendor patches as soon as they are available.
• Run all software with the least privileges required while still maintaining functionality.
• Avoid handling files from unknown or questionable sources.
• Never visit sites of unknown or questionable integrity.
• Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft's summary of the December 2019 releases can be found here:
https://portal.msrc.microsoft.com/en-us/security-guidance

 

This month's update covers vulnerabilities in:

• Internet Explorer
• Microsoft Office
• Microsoft Windows
• Microsoft Hyper-V
• Graphics Device Interface (GDI)
• Microsoft Windows Kernel
• SQL Server
• Visual Studio
• Microsoft Authentication Library for Android
• Microsoft Defender
• Skype for Business Server

 

The following is a breakdown of the issues being addressed this month:

1. Cumulative Security Update for Microsoft Internet Explorer

   VBScript Remote Code Execution Vulnerability (CVE-2019-1485) MS Rating: Important

   A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

2. Cumulative Security Update for Microsoft Office

   Microsoft Word Denial of Service Vulnerability (CVE-2019-1461) MS Rating: Important

   A denial of service vulnerability exists in Microsoft Word software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could cause a remote denial of service against a system.

    

   Microsoft PowerPoint Remote Code Execution Vulnerability (CVE-2019-1462) MS Rating: Important

   A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.

    

   Microsoft Access Information Disclosure Vulnerability (CVE-2019-1463) MS Rating: Important

   An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user's system.

    

   Microsoft Excel Information Disclosure Vulnerability (CVE-2019-1464) MS Rating: Important

   An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user's computer or data.

    

   Microsoft Access Information Disclosure Vulnerability (CVE-2019-1400) MS Rating: Important

   An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user's system.

    

3. Cumulative Security Update for Microsoft Windows Kernel

   Win32k Privilege Escalation Vulnerability (CVE-2019-1458) MS Rating: Important

   A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

    

   Win32k Information Disclosure Vulnerability (CVE-2019-1469) MS Rating: Important

   An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system.

    

   Windows Kernel Information Disclosure Vulnerability (CVE-2019-1472) MS Rating: Important

   An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user's system.

    

   Windows Kernel Information Disclosure Vulnerability (CVE-2019-1474) MS Rating: Important

   An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user's system.

    

4. Cumulative Security Update for Microsoft Hyper-V

   Windows Hyper-V Remote Code Execution Vulnerability (CVE-2019-1471) MS Rating: Critical

   A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code.

    

   Windows Hyper-V Information Disclosure Vulnerability (CVE-2019-1470) MS Rating: Important

   An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker on a guest operating system could run a specially crafted application that could cause the Hyper-V host operating system to disclose memory information.

    

5. Security Update for Microsoft Graphics

   Win32k Graphics Remote Code Execution Vulnerability (CVE-2019-1468) MS Rating: Critical

   A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited this vulnerability could take control of the affected system.

    

   Windows GDI Information Disclosure Vulnerability (CVE-2019-1465) MS Rating: Important

   An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system.

    

   Windows GDI Information Disclosure Vulnerability (CVE-2019-1466) MS Rating: Important

   An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system.

    

   Windows GDI Information Disclosure Vulnerability (CVE-2019-1467) MS Rating: Important

   An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system.

    

6. Security Update for Microsoft Windows

   Windows Privilege Escalation Vulnerability (CVE-2019-1476) MS Rating: Important

   A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

    

   Windows Printer Service Privilege Escalation Vulnerability (CVE-2019-1477) MS Rating: Important

   A privilege escalation vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer drivers. An authenticated attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges.

    

   Windows COM Server Privilege Escalation Vulnerability (CVE-2019-1478) MS Rating: Important

   A privilege escalation vulnerability exists when Windows improperly handles COM object creation. An attacker who successfully exploited the vulnerability could run arbitrary code with elevated privileges.

    

   Windows Media Player Information Disclosure Vulnerability (CVE-2019-1480) MS Rating: Important

   An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could potentially read data that was not intended to be disclosed.

    

   Windows Media Player Information Disclosure Vulnerability (CVE-2019-1481) MS Rating: Important

   An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could potentially read data that was not intended to be disclosed.

    

   Windows Privilege Escalation Vulnerability (CVE-2019-1483) MS Rating: Important

   A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions. To exploit this vulnerability, an attacker would first have to gain execution on the victim system.

    

   Windows OLE Remote Code Execution Vulnerability (CVE-2019-1484) MS Rating: Important

   A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input. An attacker could exploit the vulnerability to execute malicious code.

    

   Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability (CVE-2019-1453) MS Rating: Important

   A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on the target system to stop responding.

    

   Remote Desktop Protocol Information Disclosure Vulnerability (CVE-2019-1489) MS Rating: Important

   An information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP) fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user's system.

7. Security Update for Microsoft SQL Server

   Microsoft SQL Server Reporting Services XSS Vulnerability (CVE-2019-1332) MS Rating: Important

   A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web request to an affected SSRS server. An attacker who successfully exploited the vulnerability could run scripts in the contect of the targeted user.

    

8. Security Update for Microsoft Visual Studio

   Git for Visual Studio Remote Code Execution Vulnerability (CVE-2019-1349) MS Rating: Critical

   A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input. An attacker who successfully exploited this vulnerability could take control of an affected system.

    

   Git for Visual Studio Remote Code Execution Vulnerability (CVE-2019-1350) MS Rating: Critical

   A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input. An attacker who successfully exploited this vulnerability could take control of an affected system.

    

   Git for Visual Studio Remote Code Execution Vulnerability (CVE-2019-1352) MS Rating: Critical

   A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input. An attacker who successfully exploited this vulnerability could take control of an affected system.

    

   Git for Visual Studio Remote Code Execution Vulnerability (CVE-2019-1354) MS Rating: Critical

   A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input. An attacker who successfully exploited this vulnerability could take control of an affected system.

    

   Git for Visual Studio Remote Code Execution Vulnerability (CVE-2019-1387) MS Rating: Critical

   A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input. An attacker who successfully exploited this vulnerability could take control of an affected system.

    

   Visual Studio Live Share Spoofing Vulnerability (CVE-2019-1486) MS Rating: Important

   A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the session host. An attacker who successfully exploited this vulnerability could cause a connected guest's computer to open a browser and navigate to a URL without consent from the guest.

    

   Git for Visual Studio Tampering Vulnerability (CVE-2019-1351) MS Rating: Moderate

   A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system.

    

9. Security Update for Microsoft Authentication Library for Android

   Microsoft Authentication Library for Android Information Disclosure Vulnerability (CVE-2019-1487) MS Rating: Important

   An information disclosure vulnerability in Android Apps using Microsoft Authentication Library (MSAL) 0.3.1-Alpha or later exists under specific conditions. This vulnerability could result in sensitive data being exposed.

    

10. Security Update for Microsoft Defender

    Microsoft Defender Security Bypass Vulnerability (CVE-2019-1488) MS Rating: Important

    A security bypass vulnerability exists when Microsoft Defender improperly handles specific buffers. An attacker could exploit the vulnerability to trigger warnings and false positives when no threat is present.

11. Security Update for Skype for Business Server

    Skype for Business and Lync Spoofing Vulnerability (CVE-2019-1490) MS Rating: Important

    A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected server.

More information is available on Symantec's free Security Center portal and to our customers through the DeepSight Threat Management System.