Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 72 vulnerabilities that were fixed in 9 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 9 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Internet Explorer Security Update for February 2019

  Severity

  Critical 4

  Qualys ID

  100359

  Vendor Reference

  KB4486474, KB4486563, KB4486996, KB4487000, KB4487017, KB4487018, KB4487020, KB4487023, KB4487025, KB4487026, KB4487044

  CVE Reference

  CVE-2019-0606, CVE-2019-0654, CVE-2019-0676

  CVSS Scores

  Base 7.6 / Temporal 6.3

  Description

  Internet Explorer is a web-browser developed by Microsoft which is included in Microsoft Windows Operating Systems.

  Microsoft has released Cumulative Security Updates for Internet Explorer which addresses various vulnerabilities found in Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11). The most severe of the vulnerabilities could allow remote code execution.

  QID Detection Logic (Authenticated):
  Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7,Windows Embedded Standard 7 , Windows Embedded 8 Standard, Windows 8.1, Windows RT 8.1, Windows 10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016,Windows Server 2019.
  

  This QID checks for the file version of %windir%\System32\mshtml.dll

  The following versions of mshtml.dll with their corresponding KBs are verified:
  1.KB4486563 - 11.0.9600.19267
  2.KB4487044 - 11.0.17763.316
  3.KB4487017 - 11.0.17134.590
  4.KB4486474 - 8.0.6001.24159,9.0.8112.21312,10.0.9200.22671,11.0.9600.19267
  5.KB4487020 - 11.0.15063.1631
  6.KB4487023 - 9.0.8112.21312
  7.KB4487025 - 10.0.9200.22671
  8.KB4487026 - 11.0.14393.2791
  9.KB4486996 - 11.0.16299.967
  10.KB4487000 - 11.0.9600.19267
  11.KB4487018 - 11.0.10240.18132
  

  Consequence

  Successful exploitation of the vulnerability can lead to arbitrary code execution within the context of the current user.

  Solution

  For more information, refer to the Security Update Guide.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Update Guide

• Microsoft Windows Adobe Flash Player Security Update for February 2019 (ADV190003)

  Severity

  Serious 3

  Qualys ID

  100360

  Vendor Reference

  ADV190003

  CVE Reference

  CVE-2019-7090

  CVSS Scores

  Base 4.3 / Temporal 3.2

  Description

  This security update fixes a Remote Code Execution Bug with the Action Script Virtual Machine (AVM) module, that could lead to information disclosure in the context of the current user.

  Affected Versions:
  Windows 8 Embedded, Windows 10 Version 1803, Windows Server 2016, Windows 10 Version 1709, Windows 10 Version 1809, Windows 10 Version 1703, Windows 10 Version 1607, Windows 10, Windows Server 2012 R2, Windows 8.1, Windows RT 8.1, Windows Server 2019 and Windows Server 2012 with Adobe Flash Player version 32.0.0.114 and earlier.

  QID Detection Logic:
  This authenticated QID will flag if file version of %windir%\System32\Macromed\Flash\Flash.ocx is less than or equal to 32.0.0.114.

  Consequence

  Successful exploitation could lead to Information Disclosure in the context of the current user.

  Solution

  Customers are advised to follow 4487038 for instructions pertaining to the remediation of this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  ADV190003 Windows(Flash)

• Microsoft Office and Microsoft Office Services and Web Apps Security Update February 2019

  Severity

  Critical 4

  Qualys ID

  110330

  Vendor Reference

  KB4018294, KB4018300, KB4018313, KB4092465, KB4461597, KB4461607, KB4461608, KB4461630, KB4462115, KB4462138, KB4462139, KB4462143, KB4462146, KB4462154, KB4462155, KB4462171, KB4462174, KB4462177, KB4462184, KB4462186, KB4462199, KB4462202, KB4462211

  CVE Reference

  CVE-2019-0540, CVE-2019-0594, CVE-2019-0604, CVE-2019-0668, CVE-2019-0669, CVE-2019-0670, CVE-2019-0671, CVE-2019-0672, CVE-2019-0673, CVE-2019-0674, CVE-2019-0675

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft released security updates in February 2019 to fix multiple security vulnerabilities.

  This security update contains the following KBs:
  KB4018294
  KB4018300
  KB4018313
  KB4092465
  KB4461597
  KB4461607
  KB4461608
  KB4461630
  KB4462115
  KB4462138
  KB4462139
  KB4462143
  KB4462146
  KB4462154
  KB4462155
  KB4462171
  KB4462174
  KB4462177
  KB4462186
  KB4462211
  KB4462202
  KB4462184
  KB4462199

  Affected Software:
  Microsoft Excel 2010 Service Pack 2 (32-bit editions)
  Microsoft Excel 2010 Service Pack 2 (64-bit editions)
  Microsoft Excel 2013 RT Service Pack 1
  Microsoft Excel 2013 Service Pack 1 (32-bit editions)
  Microsoft Excel 2013 Service Pack 1 (64-bit editions)
  Microsoft Excel 2016 (32-bit edition)
  Microsoft Excel 2016 (64-bit edition)
  Microsoft Excel Viewer
  Microsoft Office 2010 Service Pack 2 (32-bit editions)
  Microsoft Office 2010 Service Pack 2 (64-bit editions)
  Microsoft Office 2013 RT Service Pack 1
  Microsoft Office 2013 Service Pack 1 (32-bit editions)
  Microsoft Office 2013 Service Pack 1 (64-bit editions)
  Microsoft Office 2016 (32-bit edition)
  Microsoft Office 2016 (64-bit edition)
  Microsoft Office 2016 for Mac
  Microsoft Office 2019 for 32-bit editions
  Microsoft Office 2019 for 64-bit editions
  Microsoft Office 2019 for Mac
  Microsoft Office Compatibility Pack Service Pack 3
  Microsoft Office Word Viewer
  Microsoft PowerPoint Viewer
  Microsoft SharePoint Enterprise Server 2013 Service Pack 1
  Microsoft SharePoint Enterprise Server 2016
  Microsoft SharePoint Foundation 2010 Service Pack 2
  Microsoft SharePoint Foundation 2013 Service Pack 1
  Microsoft SharePoint Server 2010 Service Pack 2
  Microsoft SharePoint Server 2013 Service Pack 1
  Microsoft SharePoint Server 2019
  Office 365 ProPlus for 32-bit Systems
  Office 365 ProPlus for 64-bit Systems

  QID Detection Logic:
  This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.

  Consequence

  Successful exploitation allows an attacker to execute arbitrary code.

  Solution

  Refer to CVE-2019-0540, CVE-2019-0594, CVE-2019-0604, CVE-2019-0668, CVE-2019-0669, CVE-2019-0670, CVE-2019-0671, CVE-2019-0672, CVE-2019-0673, CVE-2019-0674, CVE-2019-0675 for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Excel Information Disclosure Vulnerability
  Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
  Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
  Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
  Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
  Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
  Microsoft Office Security Feature Bypass Vulnerability
  Microsoft SharePoint Elevation of Privilege Vulnerability
  Microsoft SharePoint Remote Code Execution Vulnerability
  Microsoft SharePoint Remote Code Execution Vulnerability
  Microsoft SharePoint Spoofing Vulnerability

• Microsoft Skype for Business 2015 Spoofing Vulnerability

  Severity

  Serious 3

  Qualys ID

  371640

  Vendor Reference

  Skype for Business 2015

  CVE Reference

  CVE-2019-0624

  CVSS Scores

  Base 3.5 / Temporal 2.6

  Description

  Skype for Business Server is real-time communications server software that provides the infrastructure for enterprise instant messaging, presence, VoIP, ad hoc and structured conferences and PSTN connectivity through a third-party gateway or SIP trunk.

  A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Skype for Business server.
  For the vulnerability to be exploited, a user must click a specially crafted URL that takes the user to a targeted Skype for Business site.
  In an email attack scenario, an attacker could exploit the vulnerability by sending an email message containing the specially crafted URL to the user of the targeted Skype for Business site and convincing the user to click the specially crafted URL.

  Affected Versions:
  Skype for Business Server 2015 prior to CU8

  QID Detection Logic:(Authenticated)
  It checks for vulnerable version of Skype Business Server 2015 by checking its fileversion.

  Consequence

  On successful exploitation an attacker could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user which allows unauthorized modification.

  Solution

  The vendor as addressed the vulnerability with Skype Business Server 2015 CU8.
  For more information please visit advisory

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Skype Business Server CU8

• Microsoft Windows Exchange Server Update for February 2019 (ADV190007)(ADV190004)

  Severity

  Serious 3

  Qualys ID

  53021

  Vendor Reference

  ADV190004, ADV190007, CVE-2019-0686, CVE-2019-0724

  CVE Reference

  CVE-2019-0686, CVE-2019-0724

  CVSS Scores

  Base 9.3 / Temporal 8.4

  Description

  Microsoft Exchange Server is affected by an elevation of privilege vulnerabilities. An attacker who successfully exploits the vulnerability may impersonate any other user of the Exchange server. To exploit this vulnerability, an attacker would need to execute a man-in-the-middle attack to forward an authentication request to a Microsoft Exchange Server, thereby allowing impersonation of another Exchange user. (ADV190007, CVE-2019-0686 and CVE-2019-0724)

  Microsoft Exchange Server uses certain elements of the Oracle Outside In libraries. This update contains fixes for Oracle Outside as fixed in Oracle Critical Patch Update Advisory - October 2018. (ADV190004)

  Affected Products and Versions:
  Microsoft Exchange Server 2010 Service Pack 3
  Microsoft Exchange Server 2013
  Microsoft Exchange Server 2016
  Microsoft Exchange Server 2019

  QID Detection Logic (authenticated):
  The QID checks for the version of file Exsetup.exe.
  The version for Microsoft Exchange Server 2010 SP3 Cumulative Update 26 is 14.3.442.0
  The version for Microsoft Exchange Server 2013 Cumulative Update 22 is 15.0.1473.3
  The version for Microsoft Exchange Server 2016 Cumulative Update 12 is 15.1.1713.5
  The version for Microsoft Exchange Server 2019 Cumulative Update 1 is 15.2.330.5

  Consequence

  Successful exploitation of the vulnerability will allow elevation of privileges.

  Solution

  Refer to ADV190007, ADV190004, CVE-2019-0686 and CVE-2019-0724 for more details pertaining to these vulnerabilities.

  Workaround:
  To prevent EWS from leaking the Exchange server's NTLM credentials is to block EWS subscriptions from being created.To prevent EWS subscriptions from being created, use the following steps:

  1) Create an organization-scoped policy that blocks all EWS subscriptions:
  New-ThrottlingPolicy -Name NoEwsSubscriptions -ThrottlingPolicyScope Organization -EwsMaxSubscriptions 0

  2) Create a regular-scoped policy, which can be used to whitelist trusted users who must have full EWS functionality:
  New-ThrottlingPolicy -Name AllowEwsSubscriptions -ThrottlingPolicyScope Regular -EwsMaxSubscriptions 5000

  3) Assign the regular policy to any such users:
  Set-Mailbox User1 -ThrottlingPolicy AllowEwsSubscriptions

  NOTE: Customer's should test their environment for the above workaround before it is deployed in production as it can be disruptive for some applications.

• Microsoft Edge Security Update for February 2019

  Severity

  Urgent 5

  Qualys ID

  91502

  Vendor Reference

  KB4486996, KB4487017, KB4487018, KB4487020, KB4487026, KB4487044

  CVE Reference

  CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0634, CVE-2019-0640, CVE-2019-0641, CVE-2019-0642, CVE-2019-0643, CVE-2019-0644, CVE-2019-0645, CVE-2019-0648, CVE-2019-0649, CVE-2019-0650, CVE-2019-0651, CVE-2019-0652, CVE-2019-0654, CVE-2019-0655, CVE-2019-0658

  CVSS Scores

  Base 7.6 / Temporal 5.6

  Description

  Microsoft Edge is a web browser developed by Microsoft that replaces Internet Explorer as the default web browser. Microsoft Edge is vulnerable to multiple issues.

  The KB Articles associated with the update:
  KB4487026
  KB4487018
  KB4487020
  KB4486996
  KB4487017
  KB4487044

  The QID Detection Logic (Authenticated):
  This QID reviews the file version of %windir%\System32\edgehtml.dll
  The patch version is 11.0.10240.18132 (KB4487018)
  The patch version is 11.0.14393.2791 (KB4487026)
  The patch version is 11.0.15063.1631 (KB4487020)
  The patch version is 11.0.16299.967 (KB4486996)
  The patch version is 11.0.17134.590 (KB4487017)
  The patch version is 11.0.17763.316 (KB4487044)
  

  Consequence

  Depending on the vulnerability being exploited, a remote attacker could exploit these vulnerabilities to bypass security restrictions, gain access to sensitive data or execute arbitrary code on the targeted system.

  Solution

  Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Update Guide Windows(Edge)

• Microsoft .NET Framework Security Update February 2019

  Severity

  Critical 4

  Qualys ID

  91503

  Vendor Reference

  KB4483449, KB4483450, KB4483451, KB4483452, KB4483453, KB4483454, KB4483455, KB4483456, KB4483457, KB4483458, KB4483459, KB4483468, KB4483469, KB4483470, KB4483472, KB4483473, KB4483474, KB4483481, KB4483482, KB4483483, KB4483484, KB4486996, KB4487017, KB4487018, KB4487020

  CVE Reference

  CVE-2019-0613, CVE-2019-0657

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  A remote code execution vulnerability exists in .NET Framework software when the software fails to check the source markup of a file.

  A vulnerability exists in certain .Net Framework APIs in the way they parse URLs.

  KB4483449, KB4483450, KB4483451, KB4483452, KB4483453, KB4483454, KB4483455, KB4483456, KB4483457, KB4483458, KB4483459, KB4483468, KB4483469, KB4483470, KB4483472, KB4483473, KB4483474, KB4483481, KB4483482, KB4483483, KB4483484, KB4486996, KB4487017, KB4487018, KB4487020 are covered in this QID.

  This security update is rated Important for supported versions of Microsoft .NET Framework.

  QID Detection Logic (Authenticated):
  This QID checks for the vulnerable file version of system.dll

  Consequence

  An attacker who successfully exploited the vulnerability can run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker can take control of the affected system.

  Solution

  Customers are advised to refer to CVE-2019-0613, CVE-2019-0657 for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2019-0657

• Microsoft Windows Security Update February 2019

  Severity

  Critical 4

  Qualys ID

  91504

  Vendor Reference

  KB4486563, KB4486564, KB4486993, KB4486996, KB4487000, KB4487017, KB4487018, KB4487019, KB4487020, KB4487023, KB4487025, KB4487026, KB4487028, KB4487044

  CVE Reference

  CVE-2019-0595, CVE-2019-0596, CVE-2019-0597, CVE-2019-0598, CVE-2019-0599, CVE-2019-0600, CVE-2019-0601, CVE-2019-0602, CVE-2019-0615, CVE-2019-0616, CVE-2019-0618, CVE-2019-0619, CVE-2019-0621, CVE-2019-0623, CVE-2019-0625, CVE-2019-0626, CVE-2019-0627, CVE-2019-0628, CVE-2019-0630, CVE-2019-0631, CVE-2019-0632, CVE-2019-0633, CVE-2019-0635, CVE-2019-0636, CVE-2019-0637, CVE-2019-0656, CVE-2019-0659, CVE-2019-0660, CVE-2019-0661, CVE-2019-0662, CVE-2019-0663, CVE-2019-0664

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. (CVE-2019-0595, CVE-2019-0596, CVE-2019-0597, CVE-2019-0598, CVE-2019-0599, CVE-2019-0625)
  An information disclosure vulnerability exists when the Human Interface Devices (HID) component improperly handles objects in memory. (CVE-2019-0600, CVE-2019-0601)
  An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. (CVE-2019-0602, CVE-2019-0615, CVE-2019-0616, CVE-2019-0619, CVE-2019-0664)
  A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. (CVE-2019-0618, CVE-2019-0660, CVE-2019-0662)
  An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. (CVE-2019-0621, CVE-2019-0661)
  An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. (CVE-2019-0623)
  A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP server. (CVE-2019-0626)
  A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard. (CVE-2019-0627, CVE-2019-0631, CVE-2019-0632)
  An information disclosure vulnerability exists when the win32k component improperly provides kernel information. (CVE-2019-0628)
  A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests. (CVE-2019-0630, CVE-2019-0633)
  An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system. (CVE-2019-0635)
  An information vulnerability exists when Windows improperly discloses file information. (CVE-2019-0636)
  A security feature bypass vulnerability exists when Windows Defender Firewall incorrectly applies firewall profiles to cellular network connections. (CVE-2019-0637)
  An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. (CVE-2019-0656)
  An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations. (CVE-2019-0659)
  An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory. (CVE-2019-0663)

  QID Detection Logic (Authenticated):
  Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019
  This QID checks for following file versions %windir%\System32\ntoskrnl.exe:
  The patch version of 6.0.6002.24556 (KB4487023 or KB4487019)
  The patch version of 6.1.7601.24354 (KB4486563 or KB4486564)
  The patch version of 6.2.9200.22672 (KB4487025 or KB4486993)
  The patch version of 6.3.9600.19263 (KB4487000 or KB4487028)
  The patch version of 10.0.10240.18132 (KB4487018)
  The patch version of 10.0.14393.2791 (KB4487026)
  The patch version of 10.0.15063.1631 (KB4487020)
  The patch version of 10.0.16299.967 (KB4486996)
  The patch version of 10.0.17134.590 (KB4487017)
  The patch version of 10.0.17763.316 (KB4487044)
  

  Consequence

  Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.

  Solution

  Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Guidance Windows

• Microsoft Visual Studio 2017 Security Update February 2019

  Severity

  Critical 4

  Qualys ID

  91505

  Vendor Reference

  Visual Studio 2017 version 15.0 (26228.73), Visual Studio 2017 version 15.9.7

  CVE Reference

  CVE-2019-0613, CVE-2019-0657

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  A remote code execution vulnerability exists in visual studio software when the software fails to check the source markup of a file.

  A vulnerability exists in visual studio in the way they parse URLs.

  This security update is rated Important for supported versions of Microsoft Visual Studio 2017.

  QID Detection Logic (Authenticated):
  This QID checks for the vulnerable file version of devenv.exe on all instances of Visual Studio.

  Consequence

  An attacker who successfully exploited the vulnerability can run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker can take control of the affected system.

  Solution

  Customers are advised to refer to CVE-2019-0613, CVE-2019-0657 for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Visual Studio 2017 version 15.0 (26228.73)
  Visual Studio 2017 version 15.9.7

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.