February 2019 Patch Tuesday has seen almost 150 vulnerabilities fixed by Microsoft and Adobe, including 43 critical Adobe flaws and 20 critical Microsoft vulnerabilities, one of which is being actively exploited in the wild.
The actively exploited vulnerability was discovered by the Google Project Zero team. The vulnerability is in Internet Explorer 11 – CVE-2019-0676 – and could be exploited if a user visits a specially crafted website. The flaw is an information disclosure issue due to how IE handles objects in the memory. If exploited, an attacker could check for the presence of files on the user’s hard drive. Microsoft has already advised all users to switch to Edge and not to use IE as the default browser due to security risks associated with IE.
February 2019 Patch Tuesday has seen Microsoft fix four vulnerabilities that were previously made public prior to a patch being released. All four of those flaws are rated important. One of those, the Microsoft Exchange Server flaw known as PrivExchange – CVE-2019-0686 – was publicly disclosed last week. This privilege escalation vulnerability could allow a threat actor with a mailbox account to gain Domain Administrator privileges which would allow access to domain user credentials.
February 2019 Patch Tuesday fixes cover a wide range of Microsoft products including Windows, Microsoft Office, the .NET Framework, Visual Studio, Exchange Server, Team Foundation Server, Asure IoT SDK Dynamix, Azure, IE, Edge, and Adobe Flash Player. In addition to the 20 critical vulnerabilities, 54 have been rated important.
Al of the critical vulnerabilities could allow remote code execution if they are exploited. The critical vulnerabilities are in IE, Edge, Windows, and Sharepoint. The vulnerability with the highest CVSS v3 score (9.8) is CVE-2019-0626 – A Windows DHCP Server RCE memory corruption vulnerability
Adobe has fixed 75 important and critical vulnerabilities across its suite of products, 43 affect Adobe Reader and Adobe Acrobat and have been rated critical, although none are believed to have been exploited in the wild.