Stories
Slash Boxes
Comments

SoylentNews is people

posted by cmn32480 on Saturday March 17 2018, @06:17PM   Printer-friendly
from the patch-these-75-holes dept.

El Reg reports

The March edition of Patch Tuesday lands just hours before researchers are expected to flaunt their latest and greatest exploits at the CanSecWest Pwn2Own hacking competition in Vancouver.

Hopefully nobody was planning to use any of the 75 CVE-listed vulnerabilities Microsoft addressed today, including several for the Edge and Internet Explorer browsers that would allow remote code execution.

The fixed bugs include nine remote code execution (RCE) flaws in the Chakra scripting engine in Edge. Microsoft says the scripting bugs (such as CVE-2018-0874[1]) would allow an infected webpage to run code with the logged-in user's clearance level.

The Edge scripting engine was also the subject of four memory corruption RCE flaws, as well as an information disclosure bug, CVE-2018-0839[1], that allows an attack page to view objects in memory.

Just two of the 75 Microsoft bugs squashed this month have been publicly disclosed. They include an elevation of privilege bug in Exchange (CVE-2018-0940[1]) exploited via email. Dustin Childs of the Zero Day Initiative said that the bug is perfectly set up to facilitate a spear phishing attack.

[1] All content at portal.msrc.microsoft.com is behind scripts. Attempts to have archive.is run the scripts results in a EULA page.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 1, Interesting) by Anonymous Coward on Sunday March 18 2018, @08:39AM

    by Anonymous Coward on Sunday March 18 2018, @08:39AM (#654392)

    Did a mini study on the subject and looks like GNU/Linux was a target in 2008 and didn't fall although one participant boasted that his method would have taken only hours to refine to successfully attack GNU/Linux. The stance since has been to not include GNU/Linux since all individual distros have such a small slice of the entire PC userbase. Featured again in 2017 and this take taken down. Since Micro$oft is a sponsor since this year, I don't think we'll see GNU/Linux any time soon. However they did have the Apache and NGINX web servers as well as OpenSSL as targets which is nice.

    Starting Score:    0  points
    Moderation   +1  
       Interesting=1, Total=1
    Extra 'Interesting' Modifier   0  

    Total Score:   1