Microsoft March Patch Tuesday comes with fixes for two Windows zero-days

Microsoft rolled out today its monthly batch of security patches known as Patch Tuesday.

This month, the Redmond-based company fixed 64 vulnerabilities, 17 of which were rated critical, including two zero-days affecting in its main product, the Windows operating system.

First Windows zero-day

The first of these zero-days is one that Google made public last week. Google said this zero-day was being abused in attacks against Windows 7 32-bit users.

Today Microsoft didn’t release patches for Windows 7 only, but also for Windows Server 2008 systems, which are also impacted by this issue –tracked as CVE-2019-0808.

According to a Google security alert from last week, attackers used the Windows zero-day together with a Chrome zero-day to escape the Chrome browser sandbox and execute malicious code on targeted systems.

CVE-2019-0808’s role in the exploit chain was to allow attackers to execute their malicious code with elevated admin privileges once the Chrome zero-day helped attackers escape from the Chrome security sandbox.

Google, too, patched its side of the aisle last week, with the release of Chrome 72.0.3626.121.

Second Windows zero-day

Further, Microsoft also patched a second zero-day today, discovered by Kaspersky researchers, and tracked as CVE-2019-0797. Just like the first, this zero-day is an elevation of privilege (EoP) bug that can allow attackers to run code with admin privileges.

“An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory,” Microsoft said today in a security advisory. “An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”

This zero-day impacts all Windows versions, including Windows 10. Neither Microsoft or Kaspersky revealed any details about the attacks exploiting this zero-day.

Other fixes

In addition to the two zero-days, Microsoft fixed (again) three major vulnerabilities in the Windows DHCP client that could allow remote attackers to take over vulnerable machines (CVE-2019-0697, CVE-2019-0698, and CVE-2019-0726).

The OS maker has been patching lots of these DHCP security flaws lately, with at least one in almost every Patch Tuesday released in the last few months.

Last but not least, Microsoft also corrected a patch for a Windows Deployment Services (WDS) bug it initially fixed last year. This bug is different from a similar WDS bug reported by Check Point.

For additional information on the other bugs patched in this month’s Patch Tuesday, please refer to the table embedded below, or to this Patch Tuesday report generated by ZDNet or this alternative one assembled by Trend Micro’s Zero-Day Initiative, or this one by SANS.

Additional information is also available on Microsoft’s official Security Update Guide portal, which also includes interactive filtering options so users can find the updates and patches for only the products that are of interest.

Since the Microsoft Patch Tuesday is also the day when other vendors also release security patches, it’s also worth mentioning that Adobe released its batch earlier today. This month, the company has shipped security updates for Adobe Photoshop CC, its image editing software, and Digital Editions, its e-book reader app.

Another company which released security updates is SAP. Its updates are here.

More vulnerability reports: