Technology 3 min read

Microsoft Releases June Patch Tuesday to Fix Zero-Day Vulnerabilities

znakki / Shutterstock.com

znakki / Shutterstock.com

Microsoft has already rolled out its June 2019 patch last Tuesday which reportedly fixed four out of the five zero-day vulnerabilities discovered last month. According to Google security researcher Tavis Ormandy, Microsoft confirmed that the patch for the fifth vulnerability would not be ready until July since its details were only published last week.

Tavis, a member of Google’s Project Zero team, revealed the news in a tweet yesterday. He tweeted:

“Microsoft committed to fixing it in 90 days, then didn’t. Today is day 91, so the issue is now public. I consider this relatively low severity, but you could take down an entire Windows fleet relatively easily, so it’s worth being aware of.”

The proof-of-concept codes for the five vulnerabilities were published on the Microsoft-owned code-sharing site GitHub by a disgruntled tech expert who goes by the code name SandboxEscaper.

The Zero-Day Vulnerabilities

The five Windows zero-day vulnerabilities were identified as follows:

  • CVE-2019-1069
  • CVE-2019-1064
  • CVE-2019-1053
  • CVE-2019-0973
  • CVE-2019-0708

The CVE-2019-1069 or the BearLPE was an elevation of privilege vulnerability in the Task Scheduler Service‘s validation of file operations. If exploited, it could allow attackers to gain elevated privileges to a Window’s system.

On the other hand, the CVE-2019-1064 or CVE-2019-0841-BYPASS was a vulnerability found in the Windows AppX Deployment Service. If exploited by attackers, this bug could allow them to install programs or change, delete, and view a victim’s data.

The CVE-2019-1053 or the SandboxEscape bug exists when the Windows Shell fails to validate folder shortcuts. An attacker could use this bug to gain elevated privileges by escaping sandbox.

Next, the CVE-2019-0973 or the InstallerBypass bug occurs when the Windows Installer fails to clean input, leading to an insecure library loading behavior.

The last bug, the CVE-2019-0708 or the BlueKeep, is a remote code execution vulnerability that exists in the Windows Remote Desktop Services. This particular bug doesn’t require user interaction and could allow attackers to install programs or change, view, and delete data on a target system.

Aside from fixing four of the five zero-day vulnerabilities, the recent patch also took care of 88 CVE, 22 of which were reportedly rated as “critical” by the Microsoft security team.

Despite making the proof-of-concept codes available to the public, Microsoft has not received any reports yet about malware campaigns involving the said vulnerabilities.

The company is encouraging all Windows PC users to check their computer settings and apply the update.

Read More: Google Finds An Issue With Its Bluetooth Titan Security Keys

First AI Web Content Optimization Platform Just for Writers

Found this article interesting?

Let Chelle Fuertes know how much you appreciate this article by clicking the heart icon and by sharing this article on social media.


Profile Image

Chelle Fuertes

Chelle is the Product Management Lead at INK. She's an experienced SEO professional as well as UX researcher and designer. She enjoys traveling and spending time anywhere near the sea with her family and friends.

Comments (0)
Most Recent most recent
You
share Scroll to top

Link Copied Successfully

Sign in

Sign in to access your personalized homepage, follow authors and topics you love, and clap for stories that matter to you.

Sign in with Google Sign in with Facebook

By using our site you agree to our privacy policy.