Rewterz Threat Advisory – Update fixes IE 0-day RCE vulnerability and 74 other flaws in Microsoft Products

Severity

High

Analysis Summary

Microsoft has released November updates to fix 75 security flaws in multiple products.

CVE-2019-1429 – Scripting Engine Memory Corruption Vulnerability could allow an attacker to conduct a web-based attack via specially crafted web pages that exploits the vulnerability. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked “safe for initialization” in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.

Microsoft also fixed a publicly disclosed vulnerability in Microsoft Office for Mac titled “CVE-2019-1457 | Microsoft Office Excel Security Feature Bypass” that allows attackers to bypass security restrictions. If the Microsoft Excel for Mac option “Disable all macros without notification” is enabled, XLM macros in SYLK files are executed without prompting the user. “If Office for the Mac has been configured to use the “Disable all macros without notification” feature, XLM macros in SYLK files are executed without prompting the user. This behavior is consistent even with fully-patched Office 2016 and Office 2019 for Mac systems, says Will Dormann of the CERT/CC.

Below are other vulnerabilities that are fixed in this November update:

Impact

• Memory Corruption
• Remote Code Execution
• System Takeover
• Security Bypass
• Privilege Escalation
• Information Disclosure
• Denial of Service
• Impersonation

Affected Vendors

Microsoft

Affected Products

• Microsoft Edge
• Microsoft Exchange Server
• Microsoft Graphics Component
• Microsoft JET Database Engine
• Microsoft Office
• Microsoft Office SharePoint
• Microsoft RPC
• Microsoft Windows
• Visual Studio
• Windows Hyper-V
• Windows Kernel
• Windows Media Player
• Windows Subsystem for Linux

Remediation

Install updates as soon as possible.

https://www.bleepingcomputer.com/microsoft-patch-tuesday-reports/Nov-2019.html