Grafvision - Fotolia

Spectre v4 fix and Windows DNS patch in June Patch Tuesday

A Windows DNS patch for both desktops and servers headlines Microsoft's June 2018 Patch Tuesday, but the release also includes mitigations for Spectre v4 and more.

The June 2018 Patch Tuesday release addressed a total of 51 vulnerabilities, 11 of which were deemed critical, but the headline fix was a Windows DNS patch.

Experts uniformly pointed to the Windows DNS patch (CVE-2018-8225) as the most interesting fix of the month and the one that should take priority for most enterprises. Microsoft described the Windows DNS patch as addressing a remote code execution (RCE) vulnerability that affects Windows desktop versions 7 through 10 and Windows Server 2008 and newer.

Microsoft wrote in the advisory for the Windows DNS patch that if an attacker used a malicious DNS server to send corrupted DNS responses to the target, the exploit could allow for running arbitrary code in the context of the local user permissions.

Craig Young, security researcher for Tripwire's Vulnerability and Exposure Research Team, said the full impact of the Windows DNS vulnerability "is not entirely clear."

"Microsoft describes it as a problem processing DNS responses. Normally, I would expect that to mean that the attacker must be in a position to respond to DNS requests from a victim. This would mean that the victim is either making a DNS request to a server the attacker controls or that the attacker has a privileged network position allowing them to spoof responses from a legitimate server," Young wrote via email. "In this case, however, Microsoft's CVSS v3 score indicates that there is no user interaction required to trigger the vulnerability. It could be that Microsoft did not score the vulnerability properly, but it could also mean that there are circumstances where a vulnerable system will process unsolicited responses."

Jimmy Graham, director of product management at Qualys Inc., based in Redwood City, Calif., added in a blog post that "mobile workstations that may connect to untrusted Wi-Fi are at high risk" and the Windows DNS patch should be a priority for those users.

Spectre v4 gets OS fixes

Beyond the Windows DNS patch, another highlight of the June Patch Tuesday was an update to Microsoft's advisory regarding Spectre v4 -- the latest Spectre attack method discovered in May 2018.

According to Microsoft's updated advisory, Windows now supports Speculative Store Bypass Disable (SSBD) in Intel processors, but this in itself will not protect against Spectre v4 and will require microcode patches from Intel to fully remediate.

Microsoft couldn't provide a timetable for when those microcode updates would be available, but it did warn users that "in testing Microsoft has seen some performance impact when SSBD is turned on. However, the actual performance impact will depend on multiple factors, such as the specific chipset in your physical host and the workloads that are running."

Another flaw to watch

The final critical flaw for enterprises to prioritize was CVE-2018-8267, a scripting engine memory corruption vulnerability in Internet Explorer. This patch should take priority because although there have not been any attacks seen in the wild, this flaw was publicly disclosed.

According to Microsoft, this RCE vulnerability could allow an attacker to run code in the context of the current user either by luring a target to a malicious website or by embedding a malicious ActiveX control in a Microsoft Office document.

Dig Deeper on Application and platform security

Enterprise Desktop
  • Understanding how GPOs and Intune interact

    Group Policy and Microsoft Intune are both mature device management technologies with enterprise use cases. IT should know how to...

  • Comparing MSI vs. MSIX

    While MSI was the preferred method for distributing enterprise applications for decades, the MSIX format promises to improve upon...

  • How to install MSIX and msixbundle

    IT admins should know that one of the simplest ways to deploy Windows applications across a fleet of managed desktops is with an ...

Cloud Computing