These two zero-days precisely are privilege escalation bugs. While both of these attained important severity rating, they became a problem owing to their active exploitation in the wild.
The first of these is an EoP in the Windows Common Log File System Driver (CVE-2019-1214). The bug existed due to improper object handling in the memory by Windows CLFS. Upon an exploit, the flaw could let an attacker execute processes with elevated user privileges. Regarding the exploit condition, Microsoft stated in their advisory,
To exploit the vulnerability, an attacker would first have to log on to the system, and then run a specially crafted application to take control over the affected system.Whereas, the other EoP existed in the ws2ifsl.sys (Winsock) owing to improper object handling in memory. Regarding this Windows vulnerability (CVE-2019-1215), Microsoft explained in the advisory,
An attacker who successfully exploited the vulnerability could execute code with elevated privileges. To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.
Microsoft also fixed 60 other important severity bugs in various products. These bugs, upon exploit, could result in information disclosure, spoofing, elevation of privileges, or even remote code execution.
In addition, Microsoft also patched a moderate severity spoofing vulnerability (CVE-2019-1259), in Microsoft SharePoint.
In August, Microsoft addressed 93 vulnerabilities with its Patch Tuesday bundle, more than the ones addressed this month. However, the previous month’s patches did not include any actively exploited bugs.
Make sure to update your systems at the earliest to stay protected from potential attacks.
