Microsoft Releases Patch Tuesday May 2018
Target: Microsoft Users
Attack Vector: Varied
Summary: Microsoft has this week released their May installment of 2018’s patch Tuesday. The update addresses 67 vulnerabilities ranging from Critical to Low in severity. This includes two zero-day vulnerabilities that can be exploited for remote code execution in addition to privilege escalation. The first, CVE-2018-8174, affects not only Internet Explorer, but also any other projects that embed the Internet Explorer web rendering engine. The second, CVE-2018-8120, is an elevation of privilege vulnerability in the Win32k component. Flash player based flaws were also a major focus for Microsoft this month, including CVE 2018-4944, a confusion vulnerability that can allow for arbitrary code execution.
Risk assessment summary: This threat is assessed at 3c MODERATE. If unpatched, two of the vulnerabilities provide attackers with privilege escalation and the ability to execute remote code. The risk is further increased as two of these vulnerabilities are already known to be exploited, thus unpatched users are currently at risk of infection. Another two vulnerabilities have also been made public resulting in further risk to an unpatched user. However, the Adobe Flash bug discovered requires the user to update their system to the latest version, leaving users who have not yet updated at risk.