Microsoft released patches for vulnerabilities that were actively being exploited via their regular security release on the last few months of 2018. They released 49 security patches and two advisories for 2019, seven were vulnerabilities rated as critical while 40 were important.
The highlight of these vulnerabilities is regarding to Windows DHCP Client (CVE-2019-0547), this allows a hacker to send commands on a machine by issuing DHCP responses. Alarmingly, most machines have DHCP client enabled across all windows operating systems, therefore applying this patch is a must. Another notable vulnerability is in the Microsoft Exchange software (CVE-2019-0586), this vulnerability could allow hackers to execute code as the system users and potentially can perform various tasks such as view, change, or delete data and even create new accounts.
Luckily for Trend Micro Customers specifically for Deep Security and Tipping point customers, Trend Micro has released virtual patch rules to protect you on those vulnerabilities immediately. While testing on the security patches released by Microsoft, Trend Micro customers can first apply virtual patch rules to eliminate exposure against possible attacks. Please see below for the recommended virtual patches:
Trend Micro Deep Security and Vulnerability Protection recommended virtual patch rules are as follows:
- 1009452-Microsoft Windows COM Elevation Of Privilege Vulnerability (CVE-2018-8550)
- 1009462-Microsoft Edge Elevation Of Privilege Vulnerability (CVE-2019-0566)
- 1009463-Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0539)
- 1009464-Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2019-0541)
- 1009465-Microsoft Edge Memory Corruption Vulnerability (CVE-2019-0565)
- 1009466-Microsoft Windows Multiple Security Vulnerabilities (Jan-2019) – 2
- 1009468-Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0567)
- 1009469-Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0568)
Trend Micro Tipping Point MainlineDV filters to be applied are as follows:
- 33921: ZDI-CAN-7385: Zero Day Initiative Vulnerability (Microsoft Windows)
- 33927: HTTP: Microsoft Edge Type Confusion Vulnerability
- 33928: HTTP: Microsoft Edge Session Boundary Memory Corruption Vulnerability
- 33929: HTTP: Microsoft Edge Type Confusion Vulnerability
- 33930: HTTP: Microsoft Edge Use-After-Free Vulnerability
- 33931: HTTP: Microsoft Windows Kernel Information Disclosure Vulnerability
- 33948: HTTP: Microsoft Edge Type Confusion Vulnerability
- 33949: HTTP: Microsoft Internet Explorer ProgId Code Execution Vulnerability
If you have any further inquiries with regards to these vulnerabilities with Trend Micro or as a non-Trend Micro user, contact us at 893-9515 and we would be happy to answer your inquiries!