December 2018 Security Update from Microsoft – A Closer Look

Microsoft has recently rolled out the last patches of this year; December 2018 Security Update. In addition, Advisory on .NET Framework, ChackraCore, Microsoft Windows, Internet Explorer (IE), Edge, Office and Microsoft Office Services and Web Apps is released. Out of the 39 CVEs (Common Vulnerabilities and Exposure), the severity status of 9 is critical, while 30 CVEs are marked important. One of the bugs is reported to be under active attack in the Advisory.

In short, though the patch is a comparatively smaller one with just 39 CVEs, it is something you must prioritize. So, here, let’s take you through a brief review of the December 2018 Security Update Microsoft.

December 2018 Security Update from Microsoft

The update released on 11^th December 2018 (Patch Tuesday, December) is a cumulative update. The patch consists of security updates as well as all the other fixed introduced until then. You system downloads these updates automatically. If you’d like to get the stand-alone version, you can download from Microsoft Update Catalog as well.

Threats and vulnerabilities

About 25 percent of the entire release relates to browser-related bugs. Office and Office SharePoint group of application constitute to another major part of the release. Some other important patches include those for the Kernel, DirectX and other kernel-mode drivers.

Of the 39 patches released as the 2018 December security update, the following are some of the important bugs covered.

CVE-2018-8517 – .NET Framework Denial of Service Vulnerability

This bug results in .NET framework being unable to handle some web requests appropriately. When exploited, this vulnerability may result in denial of service in a web application. It is possible for an attacker to exploit this bug without any kind of authentication. Some changes are brought in, so as to handle the .NET framework denial of service vulnerabilities.

CVE-2018-8611 – Windows Kernel Elevation of Privilege Vulnerability

This vulnerability relates to Windows Kernel’s inability to handle objects in its memory. If exploited, an attacker may run specific codes arbitrarily to change data, create an account or install programs with complete user privilege. In accordance with reports, this vulnerability is already being actively exploited.

CVE-2018-8634 – Microsoft Text-To-Speech Remote Code Execution Vulnerability

This patch can be important for those who employ or use text to speech. Though the chances of attacks are sleek, vulnerabilities exist as text-to-speech involves sending an HTTP POST request to the “Speech service”. And, like in case of Elevation of Privilege threat, when exploited, the invader can take control over the system affected.

CVE-2018-8540 – .NET Framework Remote Code Injection Vulnerability

Classified ‘critical’ under severity status, RCI vulnerability involves the failure of the .NET network to correctly validate the input. When exploited, the attacker can manipulate the affected system by using susceptible .NET methods to pass a particular code or input.

Follow the entire list of CVEs –

Used abbreviations –

RCI: “Remote Code Injection”
EMC: “Engine Memory Corruption”
RCE: “Remote Code Execution”
DOS: “Denial of Service”.

A closer look at December 2018 Security Updates from Microsoft details and the complete list of CVEs in the Advisory –

That’s all!!!