Microsoft Issues Security Patches for 25 Critical Vulnerabilities

Mohit Kumar
Em 08/08/2017 no site The Hacker News

Here we go again…

As part of its August Patch Tuesday, Microsoft has today released a large batch of 48 security updates for all supported versions Windows systems and other products.

The latest security update addresses a range of vulnerabilities including 25 critical, 21 important and 2 moderate in severity.

These vulnerabilities impact various versions of Microsoft's Windows operating systems, Internet Explorer, Microsoft Edge, Microsoft SharePoint, the Windows Subsystem for Linux, Adobe Flash Player, Windows Hyper-V and Microsoft SQL Server.

CVE-2017-8620: Windows Search Remote Code Execution Vulnerability

The most interesting and critical vulnerability of this month is Windows Search Remote Code Execution Vulnerability (CVE-2017-8620), affects all versions of Windows 7 and Windows 10, which could be used as a wormable attack like the one used in WannaCry ransomware, as it utilises the SMBv1 connection.

An attacker could remotely exploit the vulnerability through an SMB connection to elevate privileges and take control of the targeted Windows computer.

"A remote code execution vulnerability exists when Windows Search handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights," Microsoft explains.

"In addition to security changes for the vulnerabilities, updates include defense-in-depth updates to help improve security-related features."

CVE-2017-8633: Windows Error Reporting Elevation of Privilege Vulnerability

Another significant elevation of privilege vulnerability resides in Windows Error Reporting (WER) that could allow an attacker to run a specially created application to gain access to administrator privileges on the targeted system to steal sensitive information.

"This update corrects the way the WER handles and executes files," the advisory says.

CVE-2017-8627: Windows Subsystem for Linux DoS Vulnerability

An important vulnerability has been identified in Windows Subsystem for Linux that could allow an attacker to execute code with elevated permissions.

"To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application. The security update addresses the vulnerability by correcting how Windows Subsystem for Linux handles NT pipes" the advisory says.

Successful exploitation eventually could allow denial of service attack, leaving the targeted system unresponsive.

Microsoft has also released critical security updates for the Adobe Flash Player for Internet Explorer, although the company would end its support for Flash at the end of 2020.

Users and IT administrators are strongly recommended to apply security patches as soon as possible to keep away hackers and cybercriminals from taking control over your computer.

For installing security updates, simply head on to Settings → Update & security → Windows Update → Check for updates, or you can install the updates manually.