Patching in Review – Week 44

We still have one more week before another Patch Tuesday, but that does not stop security researchers from finding more exploits to our everyday software. According to TheRegister, researchers at Cymulate have found an exploit within Microsoft Word that would allow an attacker to run code through user interaction. This attack is performed through embedding a video within a Word document that links to a downloadable binary. This binary is then opened within Word, allowing the attacker to run an installer through user interaction.

It appears that Microsoft will not be addressing the issue. This is a great example of a user-targeted attack that could be exploited easily through a well-crafted phishing attack. A combination of a well-educated user base and a properly updated environment will reduce the chances of attack and reduce the spread of the attack if an endpoint is compromised.

Security Releases

Apple headlines the week with a suite of major security releases for their products. Numerous vulnerabilities are remediated in Apple’s assorted operating systems including macOS and iOS with a notable vulnerability covered by BleepingComputer that affects Facetime.

iTunes and iCloud for Windows also see updates covering a total of 13 shared vulnerabilities. iTunes 12.9.1 also includes CVE-2018-4394 with a CVSSv3 score of 7.8 which promotes the patch to a High severity. These consumer-level products can be surprisingly common within enterprise environments, so make sure to scan your environment to remediate these out of date titles.

Third-Party Updates

Here are the other updates we released in our content this week. These updates might not have identified CVEs, but they still have helpful stability fixes as well as potential undisclosed security fixes:

More Patch Resources:

• Patching in Review – Week 43
• Patching in Review – Week 42
• Patching in Review – Week 40
• Patching in Review – Week 39
• Patching in Review – Week 38
• Patching in Review – Week 36
• Patching in Review – Week 35
• Patching in Review – Week 25
• Patch Tuesday Blogs
• Patch Tuesday Resource Page
• Ivanti Security Products