SANS ISC: Microsoft Patch Tuesday August 2017 - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

When Microsoft changed its update process a few months ago, we were initially no longer able to quickly produce our usual assessment of Microsoft's patches. Finally, I think we have a way to get at least some of it back, and this is our first take on it. Please let me know if I should change anything. I know a few people wrote scripts to parse the table. I would recommend that you use Microsoft's own API to do so in the future. The layout of the table may change and screen-scraping is never a good idea.

What do the fields mean:

• Description: Microsoft's description of the flaw
• MSFT Severity: The highest severity Microsoft assigned to the flaw. Sometimes, Microsoft assigns different severities to different versions of the product affected by the flaw.
• CVE: CVE Number
• Disclosed/Exploited: Has the vulnerability been publicly disclosed or exploited in the wild prior to the release of the patch
• Exploitablity: How likley is it, that this vulnerability will be exploited. (old: oldest supported version of the sooftware, current: current software version)
• Client Severity: The severity we (ISC) assigned to this vulnerability for clients (Desktops)
• Server Severtiy: The severity we (ISC) assigned to this vulnerability to servers (servers run software like IIS and are more exposed to the internet)

Expect a few updates as I am refining the table. Use our contact form for feedback.

Description				MSFT Severity
CVE	Disclosed/Exploited	Exploitability (old/current)	Client Severity	Server Severity
Scripting Engine Security Feature Bypass Vulnerability				Important
CVE 2017-8637	No/No	?/?	Important	Important
Windows Subsystem for Linux Denial of Service Vulnerability
CVE 2017-8627	Yes/No	?/?
August 2017 Flash Update				Critical
ADV170010	No/No	?/?	Critical	Critical
Volume Manager Extension Driver Information Disclosure Vulnerability				Important
CVE 2017-8668	No/No	Less Likely/Less Likely	Important	Important
Windows Error Reporting Elevation of Privilege Vulnerability				Important
CVE 2017-8633	Yes/No	More Likely/More Likely	Important	Important
Microsoft Edge Memory Corruption Vulnerability				Critical
CVE 2017-8661	No/No	?/?	Critical	Critical
Windows Subsystem for Linux Elevation of Privilege Vulnerability
CVE 2017-8622	No/No	?/?
Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability				Important
CVE 2017-8673	No/No	?/?	Important	Important
Microsoft Edge Security Feature Bypass Vulnerability				Moderate
CVE 2017-8650	No/No	?/?	Moderate	Moderate
Scripting Engine Memory Corruption Vulnerability				Critical
CVE 2017-8634	No/No	?/?	Critical	Critical
CVE 2017-8635	No/No	More Likely/More Likely
CVE 2017-8636	No/No	More Likely/More Likely
CVE 2017-8638	No/No	?/?
CVE 2017-8639	No/No	?/?
CVE 2017-8640	No/No	?/?
CVE 2017-8670	No/No	?/?
CVE 2017-8671	No/No	?/?
CVE 2017-8672	No/No	?/?
CVE 2017-8641	No/No	More Likely/More Likely
CVE 2017-8645	No/No	?/?
CVE 2017-8646	No/No	?/?
CVE 2017-8647	No/No	?/?
CVE 2017-8655	No/No	?/?
CVE 2017-8656	No/No	?/?
CVE 2017-8657	No/No	?/?
CVE 2017-8674	No/No	?/?
Windows Hyper-V Remote Code Execution Vulnerability				Important
CVE 2017-8664	No/No	Less Likely/Less Likely	Important	Important
Microsoft Browser Memory Corruption Vulnerability				Critical
CVE 2017-8669	No/No	More Likely/More Likely	Critical	Critical
CVE 2017-8653	No/No	More Likely/More Likely
Win32k Information Disclosure Vulnerability				Important
CVE 2017-8666	No/No	More Likely/More Likely	Important	Important
Express Compressed Fonts Remote Code Execution Vulnerability				Important
CVE 2017-8691	No/No	Less Likely/Less Likely	Important	Important
Windows NetBIOS Denial of Service Vulnerability				Important
CVE 2017-0174	No/No	Less Likely/Less Likely	Important	Important
Windows CLFS Elevation of Privilege Vulnerability				Important
CVE 2017-8624	No/No	More Likely/More Likely	Important	Important
Windows IME Remote Code Execution Vulnerability				Critical
CVE 2017-8591	No/No	Less Likely/Less Likely	Critical	Critical
Microsoft Office SharePoint XSS Vulnerability				Important
CVE 2017-8654	No/No	Unlikely/Unlikely	Important	Important
Windows Search Remote Code Execution Vulnerability				Critical
CVE 2017-8620	No/No	More Likely/More Likely	Critical	Critical
Microsoft SQL Server Analysis Services Information Disclosure Vulnerability				Important
CVE 2017-8516	No/No	Unlikely/Unlikely	Important	Important
Scripting Engine Information Disclosure Vulnerability				Important
CVE 2017-8659	No/No	?/?	Important	Important
Windows Hyper-V Denial of Service Vulnerability				Important
CVE 2017-8623	No/No	Unlikely/Unlikely	Important	Important
Microsoft Edge Elevation of Privilege Vulnerability				Important
CVE 2017-8503	No/No	?/?	Important	Important
CVE 2017-8642	No/No	?/?
Microsoft Edge Information Disclosure Vulnerability
CVE 2017-8662	No/No	?/?
CVE 2017-8644	No/No	?/?
CVE 2017-8652	No/No	?/?
Windows PDF Remote Code Execution Vulnerability				Critical
CVE 2017-0293	No/No	Less Likely/Less Likely	Critical	Critical
Win32k Elevation of Privilege Vulnerability				Important
CVE 2017-8593	No/No	More Likely/More Likely	Important	Important
Internet Explorer Security Feature Bypass Vulnerability				Important
CVE 2017-8625	No/No	Less Likely/Less Likely	Important	Important
Microsoft JET Database Engine Remote Code Execution Vulnerability				Critical
CVE 2017-0250	No/No	Unlikely/Unlikely	Critical	Critical
Internet Explorer Memory Corruption Vulnerability
CVE 2017-8651	No/No	?/?

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS Technology Institute
STI|Twitter|

The change by Microsoft has been the bane of my existence. Thank you so much for trying to make things easier for those of us coordinating vulnerability remediation.

LOL the "Windows Subsystem for Linux" Vulnerability

Quoting REB:The change by Microsoft has been the bane of my existence. Thank you so much for trying to make things easier for those of us coordinating vulnerability remediation.

Seconded

Any news about the SANS API about MS bulletins? I mean:

https://isc.sans.edu/api/#getmspatchcves
https://isc.sans.edu/api/#getmspatch

Thirded.

Thanks for trying to fix their mess.

Thanks for this. Its great to see a proper evaluation of the various vulnerabilities and patches again.

I'm just wondering is there some reason there are no severity ratings (M$FT or your own) for the following:
* Windows Subsystem for Linux Denial of Service Vulnerability
CVE 2017-8627
* Windows Subsystem for Linux Elevation of Privilege Vulnerability
CVE 2017-8622
* Microsoft Edge Information Disclosure Vulnerability
CVE 2017-8662
CVE 2017-8644
CVE 2017-8652
* Internet Explorer Memory Corruption Vulnerability
CVE 2017-8651