Patching in Review – Week 8 of 2019

It’s Patch Tuesday redux this week with a re-release from Adobe and an additional vulnerability addressed by Microsoft.

Before we get to the security releases this week, WinRAR made the headlines this week with the discovery of a 19-year-old vulnerability. TheHackerNews details the vulnerability in unacev2.dll where an attacker can create an .ACE file, then rename it to a .RAR file to increase the chances of user interaction. On extraction, a special-crafted file can take full control over the targeted system through arbitrary code execution. This vulnerability is currently resolved in version 5.70 beta 1, but it has yet to be included in a production release.

Security Releases

Adobe comes in as the headliner this week with an out-of-band Acrobat release to remediate a previously addressed critical CVE on Patch Tuesday. APSB19-13 details the release for all currently supported versions of Acrobat and Acrobat Reader where a bypass for CVE-2019-7089 is addressed. After the release of APSB19-07, Alex Infuhr of Cure53 commented that the information disclosure vulnerability had not been fully remediated and his discovered bypass would be reported to Adobe. Make sure to get APSB19-13 added to a patching cycle soon so this critical CVE can be fully remediated.

Microsoft has spilled into this week with a new security advisory detailing a vulnerability where IIS servers can be compromised through a DoS attack. ADV190005 details the vulnerability that affects Server 2016 as well as Windows 10 1607 through 1803. To remediate this vulnerability, Microsoft has provided a feature to define thresholds on the number of HTTP/2 SETTINGS included in a request as defined in KB4491420. Interestingly enough, this feature has been included in the latest Windows non-securities released this week. For reference, see the table below with the affected platforms and associated patches:

Third-Party Updates

Other third-party vendors have been busy this week with numerous non-security releases. While these releases are not associated with a CVE, they can include valuable stability fixes as well as undisclosed security fixes: