Skip to main content

Impact of Microsoft Delayed Patch Tuesday Increases

Microsoft has delayed their regular monthly patch Tuesday release meaning 3 vulnerabilities have been left unpatched. These vulnerabilities should now be patched on the 14th of March release.
Threat ID:
CC-1225
Category:
Threat Severity:
Medium
Threat Vector:
Published:
2 March 2017 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Microsoft has delayed their regular monthly patch Tuesday release meaning 3 vulnerabilities have been left unpatched. These vulnerabilities should now be patched on the 14th of March release.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Windows All Versions

Threat details

Microsoft stated that they discovered a “last minute issue that could impact some customers and was not resolved in time for our planned updates”. One of the vulnerabilities (CVE-2017-0016) lies within the SMB file sharing component of Windows. It allows a denial of service attack to be launched remotely and it was expected to be patched in this month’s roll out of updates. However, it remains vulnerable especially with publically accessible proof of concept code.

A second vulnerability (CVE-2017-0037) relates to Microsoft Edge and Internet Explorer. The vulnerability is a type confusion flaw found within a module in the browsers while using the POC code. It would allow remote attackers to execute arbitrary code through vectors involving a crafted Cascading Style Sheets (CSS) token sequence.

The third vulnerability (CVE-2017-0038) is within the Windows GDI library which is designed to allow Windows applications to display graphics and formatted text on video displays and printers. Patches were released in a MS16-074 June 2016 but were deemed incomplete. Despite mitigating the original POC code, further issues were discovered which allowed out of bounds heap bytes to be displayed as pixels in Internet Explorer. These pictures can be retrieved by an actor and decoded revealing potentially sensitive information such as private user data or further information about the virtual address space. These additional bugs were privately disclosed in November 2016 and have now been publically released.

CVE’s

Remediation steps

Type Step
  • Consider using alternative browser while the patches remain unavailable.
  • Consider blocking outgoing SMB connection at the WAN edge (TCP ports 139 and 445 along with UDP ports 137 and 138).
  • Be extra vigilant around suspicious emails and links.

Last edited: 17 February 2020 11:32 am