Date du conseil: 09 janvier 2019

  Description

Microsoft addresses vulnerabilities in its January security bulletin. Trend Micro Deep Security covers the following:

  • CVE-2018-8550 - Windows COM Elevation of Privilege Vulnerability
    Risk Rating: Important

    This elevation of privilege vulnerability exists in the Windows COM Aggregate Marshaler. Attackers looking to exploit this vulnerability must rely on exploitation of another vulnerability that leverages this vulnerability.


  • CVE-2019-0568 -Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the failure to handle objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability must convince a user to visit a specially crafted website that hosts the exploit to this vulnerability.


  • CVE-2019-0539 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the failure to handle objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability must convince a user to visit a specially crafted website that hosts the exploit to this vulnerability.


  • CVE-2019-0566 - Microsoft Edge Elevation of Privilege Vulnerability
    Risk Rating: Important

    This elevation of privilege vulnerability in the Microsoft Edge Browser Broker COM object is resolved by this patch. Attackers looking to exploit this vulnerability must rely on exploitation of another vulnerability that leverages this vulnerability.


  • CVE-2019-0565 - Microsoft Edge Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory by Microsoft Edge. This handling is corrected by this specific patch.


  • CVE-2019-0541 - MSHTML Engine Remote Code Execution Vulnerability
    Risk Rating: Critical

    The remote code execution vulnerability exists in the improper validation of input by the MSHTML engine. This handling is corrected by this specific patch.


  • CVE-2019-0567 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the improper handling of objects in memory by the Chakra scripting engine in Microsoft Edge. This handling is corrected by this specific patch.


  Information Exposure Rating:

Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using the Vulnerability Protection product or OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities.

Vulnerability ID DPI Rule Number DPI Rule Name Release Date Vulnerability Protection Compatibility
CVE-2019-0539 1009463 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0539) 08-Jan-19 YES
CVE-2019-0541 100964 Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2019-0541) 08-Jan-19 YES
CVE-2019-0543, CVE-2019-0552, CVE-2019-0555 1009461 Microsoft Windows Multiple Security Vulnerabilities (Jan-2019) - 1 08-Jan-19 YES
CVE-2019-0565 1009465 Microsoft Edge Memory Corruption Vulnerability (CVE-2019-0565) 08-Jan-19 YES
CVE-2019-0566 1009462 Microsoft Edge Elevation Of Privilege Vulnerability (CVE-2019-0566) 08-Jan-19 YES
CVE-2019-0567 1009468 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0567) 08-Jan-19 YES
CVE-2019-0568 1009469 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0568) 08-Jan-19 YES
CVE-2019-0569, CVE-2019-0572, CVE-2019-0573, CVE-2019-0574 1009466 Microsoft Windows Multiple Security Vulnerabilities (Jan-2019) - 2 08-Jan-19 YES