Latest Microsoft Update Patches New Windows 0-Day Under Active Attack

Microsoft’s December security updates include patches for a
total of 36 vulnerabilities, where 7 are critical, 27 important, 1
moderate, and one is low in severity—brief information on which you
can find later in this article.

Tracked as CVE-2019-1458 and rated as Important, the
newly patched zero-day Win32k privilege escalation vulnerability,
reported by Kaspersky, was used in Operation WizardOpium
attacks to gain higher privileges on targeted systems by escaping
the Chrome sandbox.

Although Google addressed the flaw in Chrome 78.0.3904.87 with
the release of an emergency update last month after Kaspersky
disclosed it to the tech giant, hackers are still targeting users
who are using vulnerable versions of the browser.

As The Hacker News reported last
month^[2], Operation WizardOpium
involved a compromised Korean-language news portal where attackers
secretly planted a then-zero-day Chrome exploit to hack computers
of its visitors.

According to Kaspersky^[3]
researchers, the Chrome use-after-free exploit was chained together
with the newly patched EoP flaw that exists in the way the Win32k
component in Windows OS handles objects in memory.

While the researchers were not able to attribute the Operation
WizardOpium attacks to any specific group of hackers, they found
some similarities in the exploit code with the infamous Lazarus hacking
group^[4].

Microsoft Patch Tuesday: December 2019

The 7 critical security vulnerabilities Microsoft patched
this month^[5] affect Git for Visual
Studio, Hyper-V Hypervisor, and Win32k Graphics component of
Windows, successful exploitation of all lead to remote code
execution attacks.

The Windows Hyper-V vulnerability (CVE-2019-1471) enables
a guest virtual machine to compromise the hypervisor, escaping from
a guest virtual machine to the host, or escaping from one guest
virtual machine to another guest virtual machine.

Git for Visual Studio contains five critical remote code
execution vulnerabilities—all reside due to the way Git for Visual
Studio sanitizes input—successful exploitation of which requires
attackers to convince a targeted user to clone a malicious
repo.

This vulnerability affects Microsoft PowerPoint 2010, 2013, and
2016 as well as Microsoft Office 2016 and 2019 for Windows and
Apple’s macOS operating systems.

Other vulnerabilities patched by Microsoft this month and marked
as important reside in the following Microsoft products and
services:

• Windows Operating System
• Windows Kernel
• Windows Remote Desktop Protocol (RDP)
• Microsoft Word
• Microsoft Excel
• Microsoft SQL Server Reporting Services
• Microsoft Access software
• Windows GDI component
• Win32k
• Windows Hyper-V
• Windows Printer Service
• Windows COM Server
• Windows Media Player
• Windows OLE
• VBScript
• Visual Studio Live Share
• Microsoft Authentication Library for Android
• Microsoft Defender
• Skype for Business and Lync
• Git for Visual Studio

Most of these vulnerabilities allow information disclosure and
elevation of privilege, and some also lead to remote code execution
attacks, while others allow cross-site scripting (XSS), security
feature bypass, spoofing, tampering, and denial of service attacks.

Windows users and system administrators are highly advised to
apply the latest security patches as soon as possible in an attempt
to keep cybercriminals and hackers away from taking control of
their computers.

For installing the latest Windows security updates, you can head
on to Settings → Update & Security → Windows Update → Check for
updates on your PC, or you can install the updates
manually.