Patch Impact Assessment November 2019

Vulnerability Assessment

1

PUBLICLY DISCLOSED

1

EXPLOITED

0

ZERO-DAY

This is a really big update for the Windows platform. And while we don’t have a zero-day vulnerability like September’s Patch Tuesday, there are two vulnerabilities that deserve our attention. The first (CVE-2019-1429) relates to a vulnerability in the Microsoft Script Engine which has been reported as publicly exploited. And the second, (CVE-2019-1457) is a publicly reported exploit in Microsoft Excel.

Threatscape

Exploitability

Windows

PATCH NOW!

VULNERABILITIES

9
CRITICAL

48
IMPORTANT

0
MODERATE

0
LOW

If you are running Windows 10 (preferably later than 1803) then there are significant changes to the Hyper-V platform that will require testing. Schedule this Windows update, with a staggered release schedule for your Windows 10 desktops.

Browsers

PATCH NOW!

VULNERABILITIES

3
CRITICAL

1
IMPORTANT

2
MODERATE

0
LOW

Unfortunately, this month there has been reports of a Microsoft Script engine vulnerabilities exploited in the wild (CVE-2019-1429) that like other related vulnerabilities could lead to arbitrary code execution in the user’s security context. There is even an ActiveX web-based attack for this vulnerability, which we thought was not really “allowed” anymore. Add these Microsoft browser updates to your “Patch Now” release cycle.

Office

SCHEDULE

VULNERABILITIES

1
CRITICAL

9
IMPORTANT

0
MODERATE

0
LOW

Unusually, there has been a publicly reported exploit for Excel (CVE-2019-1457) that though difficult to exploit. This security relies on Excel macros and the vain hope that users will not download and open Excel files sent to them from strangers. As a result of this, please add this month’s Microsoft Office update to your “Patch Now” release cycle.

Dev Tools

SCHEDULE

VULNERABILITIES

0
CRITICAL

2
IMPORTANT

0
MODERATE

0
LOW

This is a relatively quiet month for Microsoft developer tools updates with just two patches (CVE-2019-1370) and CVE-2019-1425), both rated as important by Microsoft. Affecting the open source Open Enclave SDK and Visual Studio, these two vulnerabilities may lead to an elevation of privilege security issue. Fortunately, the Visual Studio vulnerability has already been separately addressed by two NPM advisories: Arbitrary File Overwrite and the fstream version. Add this update to your regular developer update schedule.

Adobe

MARGARITA TIME!

VULNERABILITIES

0
CRITICAL

0
IMPORTANT

0
MODERATE

0
LOW

No Adobe updates for this month. If this continues into January, we will remove this section from our updates going forward. But for now, it’s Margarita time!

Understanding the Threatscape Report

The Readiness “Threatscape” report summarizes your risk of not applying this month’s patches, using all publicly-available vulnerability data.

It’s important to note that it’s equally important to know the risk to your applications if you DO apply this month’s patches. This is of course is dependent on:

The current state (version and build) of each platform (Windows, Office, Browser, etc.).
Which applications are part of your portfolio.

Luckily, determining the risk of applying patches is easy (and fast and dynamic, thanks to our Dynamic Platform Assessment tool.

To understand what will happen when you apply this month’s patches, contact us and assess your first 25 applications for free.

For each major platform, the pie chart shows the breakdown of vulnerabilities rated critical, important, moderate and low. These match the tables below the graph.

The size of the pie represents the total number of vulnerabilities. The larger the pie, the more vulnerabilities present.

The position of the pie on the vertical axis represents the relative risk to your application portfolio. The higher the position, the higher the exploitability.