Patching Week in Review – Week 35

On our last week of the summer months, the flow of patches appears to be slowing down with a comparative lull in contrast to July. However, Microsoft is keeping things interesting with an unexpected disclosure this week.

Windows Zero-Day Disclosed

To start off the week on Monday, a Twitter user named SandboxEscaper announced the existence of a Windows vulnerability with a link to GitHub containing a proof-of-concept. This vulnerability was verified on Server 2016 the same day by CERT and detailed on its vulnerability database.

This vulnerability in the APLC interface of the Windows task scheduler allows a local user to obtain SYSTEM privileges. While this appears to be only a local exploit, it is important to remember that vulnerabilities are rarely exploited in isolation.

At the time of this writing, there are no formal updates released to remediate this vulnerability. The day after the Twitter post, a Microsoft spokesperson told ZDNet a patch should be expected within the next patching schedule, so expect a fix as late as Patch Tuesday.

Security Releases

For the second month in a row, Wireshark released updates for their three branches addressing three new vulnerabilities. CVE-2018-16056, CVE-2018-16057, and CVE-2018-16058 are all related to various dissector components crashing. While the respective vulnerabilities have yet to be scored and analyzed, be sure to update your installed instances in a timely manner.

Further details are available on Wireshark’s release notes:

• Wireshark 2.6.3: https://www.wireshark.org/docs/relnotes/wireshark-2.6.3.html
• Wireshark 2.4.9: https://www.wireshark.org/docs/relnotes/wireshark-2.4.9.html 
• Wireshark 2.2.17: https://www.wireshark.org/docs/relnotes/wireshark-2.2.17.html

Third-Party Updates

Here are the other updates we released in our content this week. These updates might not have identified CVEs, but they still have helpful stability fixes as well as potential undisclosed security fixes: