Microsoft May 2019 Patch Tuesday arrives with fix for Windows zero-day, MDS attacks

Today, Microsoft released its monthly batch of security updates known as Patch Tuesday, and this month's security release includes fixes for 79 vulnerabilities in a wide range of Microsoft products.

The two headliners of this month's patches are CVE-2019-0863, a zero-day vulnerability exploited in the wild, and ADV190013, a security advisory for dealing with the latest wave of Intel CPU flaws that came to light only a few hours before.

The zero-day

The zero-day is an elevation of privilege vulnerability that exists in the way the Windows Error Reporting (WER) service interacts with files.

Tracked as CVE-2019-0863 and discovered by security researchers from PolarBear and Palo Alto Networks, this vulnerability has been used in the wild by hackers to elevate access on compromised systems from a regular account to one with admin access.

Details about these attacks are still being kept under wraps to give users more time to patch before other threat actors catch on and start abusing the same vulnerability for their own attacks.

Microsoft said it addressed this issue by "correcting the way WER handles files," and has made fixes available for all supported Windows OS versions.

MDS mitigations

But today's Patch Tuesday also comes with ADV190013, a security advisory (a FAQ page) detailing the company's mitigation plan for a new set of CPU hardware design flaws that were disclosed today -- known as MDS attacks, and impacting most Intel CPUs released in the past eight years.

Microsoft said that customers would need two types of updates. The first is firmware microcode updates that they must get from their either Intel or OEMs (device providers).

Second, there are also OS updates, which Microsoft released today, for both Windows and Windows Server. Patches for HoloLens and SQL Server have also been released.

Unfortunately, at the time of writing, Microsoft said that Intel CPU microcode updates are not yet available for the following systems:

• Windows 10 Version 1803 for x64-based Systems
• Windows Server, version 1803 (Server Core Installation)
• Windows 10 Version 1809 for x64-based Systems
• Windows Server 2019
• Windows Server 2019 (Server Core installation)

Microsoft said its cloud-based services have already been patched and are safe against any MDS attacks.

The company also warns that installing the microcode updates and software patches would impact performance, but the impact would be limited. An additional step to protect against MDS attacks would be to disable Intel CPU support for Hyper-Threading (SMT), but doing this would result in a bigger performance hit on Windows systems.

Additional details

Other notable security fixes in this month's Patch Tuesday include CVE-2019-0708, a 'wormable' flaw in Remote Desktop Services, which Microsoft has decided to patch way down to Windows XP and Server 2003 versions.

Since the Microsoft Patch Tuesday is also the day when other vendors also release security patches, it's also worth mentioning that Adobe and Apple also published their respective security updates earlier today.

More in-depth information on today's Patch Tuesday updates is available on Microsoft's official Security Update Guide portal. You can also consult the table embedded below or this Patch Tuesday report generated by ZDNet.

More vulnerability reports:

• 'Unhackable' eyeDisk flash drive exposes passwords in clear text
• Security flaws in 100+ Jenkins plugins put enterprise networks at risk
  
• Thrangrycat flaw lets attackers plant persistent backdoors on Cisco gear
• Intel CPUs impacted by new Zombieload side-channel attack
• Alpine Linux Docker images ship a root account with no password
• Over two million IoT devices vulnerable because of P2P component flaws
• KRACK attack: Here's how companies are responding CNET
• Top 10 app vulnerabilities: Unpatched plugins and extensions dominate TechRepublic