Microsoft Releases Patches For A Critical “Wormable Flaw” and 78 Other Issues

It’s Patch Tuesday—the day when Microsoft releases monthly
security updates for its software.

Microsoft has software updates to address a total of 79
CVE-listed vulnerabilities in its Windows operating systems and
other products, including a critical wormable flaw that can
propagate malware from computer to computer without requiring
users’ interaction.

Out of 79 vulnerabilities, 18 issues have been rated as critical
and rest Important in severity. Two of the vulnerabilities
addressed this month by the tech giant are listed as publicly
known, of which one is listed as under active attack at the time of
release.

May 2019 security updates address flaws in Windows OS, Internet
Explorer, Edge, Microsoft Office, and Microsoft Office Services and
Web Apps, ChakraCore, .NET Framework, and ASP.NET, Skype for
Android, Azure DevOps Server, and the NuGet Package Manager.

Critical Wormable RDP Vulnerability

The wormable vulnerability (CVE-2019-0708^[1]) resides in Remote
Desktop Services – formerly known as Terminal Services – that could
be exploited remotely by sending specially crafted requests over
RDP protocol to a targeted system.

The vulnerability could be exploited to spread wormable malware
in a similar way as the WannaCry malware spread across the globe in
2017.

Surprisingly, besides releasing patches for supported systems,
including Windows 7, Windows Server 2008 R2, and Windows Server
2008, Microsoft has also separately released fixes for
out-of-support versions of Windows including Windows 2003 and
Windows XP to address this critical issue.
As a workaround, Microsoft has advised Windows Server users to
block TCP port 3389 and enable Network Level Authentication to
prevent any unauthenticated attacker from exploiting this Wormable
flaw.

Users and system administrators are highly recommended to apply
the latest security patches as soon as possible to keep
cybercriminals and hackers away from taking control of their
computers.

For installing the latest security updates, you can head on to
Settings → Update & Security → Windows Update → Check for updates
on your computer, or you can install the updates manually.

Adobe also rolled out security updates today to fix 87 security
vulnerabilities in several of its products. Users of the
affected Adobe software for Windows, macOS, Linux, and Chrome OS
are advised to update their software packages to the latest
versions.
^[2]