News

Microsoft Delivers 'Light' September Security Patch Bundle

• By Kurt Mackie
• September 11, 2019

Microsoft on Tuesday released September security patches for Windows and applications, addressing 85 vulnerabilities.

Patches were released for supported Windows operating systems, Microsoft's Internet Explorer and EdgeHTML-based browsers, the Adobe Flash Player and much more. Microsoft offers a partial list of the software getting patches this month in these Release Notes.

Servicing Stack Updates
One peculiar detail to note is that Microsoft released Servicing Stack Updates (SSUs) for all supported Windows systems this month. Organizations typically need to install these SSUs to get future updates from Microsoft.

The release of SSUs for all Windows systems this month was "a bit out of the ordinary," according to Chris Goettl, director of product manager for security at Ivanti, in an e-mail. He noted that SSUs are typically rated Critical, but they don't actually resolve security issues. He offered the following advice on testing these SSUs:

The shortest we have seen from availability to enforcement is two months. Our guidance is to begin testing [these SSUs] as soon as possible and plan to have these in place before November to be on the safe side. Before October would be best case on the off chance Microsoft enforces these changes sooner.  

Ivanti will host a public September patch Tuesday discussion session on September 11, with sign-up available here.

Notable Vulnerabilities
Overall, the September bundle of patches address 85 vulnerabilities, with 19 rated "Critical," 65 deemed "Important" and one labeled "Moderate," according to a blog post by Jon Munshaw of Cisco's Talos security team.

Patch Tuesday counts tend to vary each month, depending the security team that counts them. Goettl, who tallied just "79 unique CVEs this month," described Microsoft's September patch bundle as "a relatively light set of updates."

Two of the Windows vulnerabilities getting patches this month (CVE-2019-1214 and CVE-2019-1215) were previously exploited. Update 9/12: Microsoft recently revised those two bulletins to say that the vulnerabilities weren't exploited after all (thanks to a Patchmanagement.org forum poster for spotting the change). Two others (CVE-2019-1235 and CVE-2019-1294) were publicly disclosed. Those circumstances are good reasons to prioritize the patching, although all four of those vulnerabilities were just rated Important, as noted by Justin Childs of Trend Micro's Zero Day Initiative, in a blog post.

Childs added that the Important Windows patch, CVE-2019-1215, addresses a low-level Windows service called the Winsock2 Integrated File System Layer, which has been "targeted by malware in the past." It's currently under attack yet again, and could permit an attacker to "go from User level to Administrator level access."

There's also an Important patch (CVE-2019-1289) that's notable for addressing a vulnerability in the Windows Update Delivery Optimization feature. The flaw was found in a component that's used to reduce network bandwidth demands during the update process, according to Childs.

SharePoint is getting a Critical patch (CVE-2019-1257) this month to address a remote code execution vulnerability. It's one of three SharePoint bugs that were discovered by the Zero Day Initiative, Childs indicated.

RDP Flaws and BlueKeep
There are four Critical patches for Windows Remote Desktop Protocol (RDP) this month, namely CVE-2019-1291, CVE-2019-1290, CVE-2019-0788 and CVE-2019-0787, according to the Cisco Talos team. However, these four vulnerabilities aren't at the same level as the so-called "BlueKeep" flaw (CVE-2019-0708) Microsoft issued patches for back in May, plus later-patched RDP flaws that are being dubbed "DejaBlue."

Here's how Childs characterized September's RDP vulnerabilities:

You'll notice there are Remote Desktop bugs being patched in this release as well, but unlike BlueKeep and DejaBlue, these members of the Blue Bug Group are all client-side. An attacker would need to convince someone to connect to their malicious RDP server or otherwise intercept (MITM) the traffic. It's good to see these issues patched, but they don't carry the urgency of the recent wormable bugs.

BlueKeep and its DejaBlue associates are the ones described as "wormable" RDP vulnerabilities. Since malware can potentially use these vulnerabilities to spread across networks, Microsoft sees them as essential to patch.

A public exploit module for BlueKeep was published by Metasploit researchers, according to a September 6 post by security solutions firm Rapid7. It's not just a proof-of-concept release to be ignored as that published code can be used against Windows 7 systems, according to security researcher Kevin Beaumont, in a Twitter post.