Microsoft Patch Tuesday – December 2017

This month, Microsoft has patched 32 vulnerabilities, 19 of which are rated Critical.

As always, customers are advised to follow these security best practices:

• Install vendor patches as soon as they are available.
• Run all software with the least privileges required while still maintaining functionality.
• Avoid handling files from unknown or questionable sources.
• Never visit sites of unknown or questionable integrity.
• Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft's summary of the December 2017 releases can be found here:
https://portal.msrc.microsoft.com/en-us/security-guidance

This month's update covers vulnerabilities in:

• Microsoft Internet Explorer
• Microsoft Edge
• Microsoft ChakraCore
• Microsoft Office
• Microsoft Exchange Server
• Microsoft Windows

The following is a breakdown of the issues being addressed this month:

1. Cumulative Security Update for Microsoft Browsers

   Microsoft Edge Memory Corruption Vulnerability (CVE-2017-11888) MS Rating: Critical

   A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11889) MS Rating: Critical

   A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11893) MS Rating: Critical

   A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11886) MS Rating: Critical

   A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11890) MS Rating: Critical

   A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11894) MS Rating: Critical

   A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11895) MS Rating: Critical

   A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11901) MS Rating: Critical

   A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11903) MS Rating: Critical

   A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11914) MS Rating: Critical

   A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. This vulnerability may corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11905) MS Rating: Critical

   A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11907) MS Rating: Critical

   A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11908) MS Rating: Critical

   A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory.This vulnerability may corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11909) MS Rating: Critical

   A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory.This vulnerability may corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11910) MS Rating: Critical

   A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. This vulnerability may corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11911) MS Rating: Critical

   A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. This vulnerability may corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11912) MS Rating: Critical

   A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11918) MS Rating: Critical

   A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. This vulnerability may corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user.

    

   Scripting Engine Information Disclosure Vulnerability (CVE-2017-11919) MS Rating: Important

   An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers. An attacker can exploit this issue to obtain sensitive information to further compromise the user's system.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11930) MS Rating: Important

   A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

   Scripting Engine Information Disclosure Vulnerability (CVE-2017-11887) MS Rating: Important

   An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker can exploit this issue to obtain sensitive information to further compromise the user's system.

    

   Scripting Engine Information Disclosure Vulnerability (CVE-2017-11906) MS Rating: Important

   An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker can exploit this issue to obtain sensitive information to further compromise the user's system.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11913) MS Rating: Important

   A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2017-11916) MS Rating: Important

   A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    

2. Cumulative Security Update for Microsoft Office

   Microsoft Exchange Spoofing Vulnerability (CVE-2017-11932) MS Rating: Important

   A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests. An attacker can exploit this issue to perform script or content injection attacks, and attempt to trick the user into disclosing sensitive information.

    

   Microsoft PowerPoint Information Disclosure Vulnerability (CVE-2017-11934) MS Rating: Important

   An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory. An attacker can exploit this issue to obtain sensitive information to compromise the user computer or data.

    

   Microsoft Excel Remote Code Execution Vulnerability (CVE-2017-11935) MS Rating: Important

   A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user.

    

   Microsoft SharePoint Elevation of Privilege Vulnerability (CVE-2017-11936) MS Rating: Important

   An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.

    

   Microsoft Office Information Disclosure Vulnerability (CVE-2017-11939) MS Rating: Important

   An information disclosure vulnerability exists when Visual Basic macros in Office improperly export a user's private key from the certificate store while saving a document. An attacker can exploit this issue to gain access to the user private key.

    

3. Cumulative Security Update for Microsoft Windows

   Windows RRAS Service Remote Code Execution Vulnerability (CVE-2017-11885) MS Rating: Important

   A remote code execution vulnerability exists in RPC if the server has Routing and Remote Access enabled. An attacker who successfully exploited this vulnerability could execute code on the target system.

    

   Microsoft Windows Security Bypass Vulnerability (CVE-2017-11899) MS Rating: Important

   A security bypass vulnerability exists when Device Guard incorrectly validates an untrusted file. An attacker who successfully exploited this issue could make an unsigned file appear to be signed.

    

   Microsoft Windows Information Disclosure Vulnerability (CVE-2017-11927) MS Rating: Important

   An information disclosure vulnerability exists when the Windows protocol handler unnecessarily sends traffic to a remote site in order to determine the zone of a provided URL. This may result in the disclosure of sensitive information to a malicious site.

    

More information is available on Symantec's free Security Center portal and to our customers through the DeepSight Threat Management System.