UPDATE 7-12-2017

The University Information Security Office (UISO) notes that the July Cumulative Security Rollup from Microsoft includes critical patches which specifically references the Windows Search Remote Code Execution vulnerability CVE-2017-8589. This vulnerability was described in the June Cumulative Security Rollup from Microsoft and included in the 2017-06-13 patch set. The patches released by Microsoft on 2017-07-11 offer additional mitigations for the vulnerability as noted by this Microsoft security advisory.

Due to the nature of this vulnerability, UISO recommends that the July Cumulative Security Rollup be applied as soon as possible and with the same priority as the June Cumulative Security Rollup.

Background

On June 13, 2017 Microsoft released a group of critical security patches in its normal patch schedule. Accompanied with this release was a security advisory that warns these "vulnerabilities are at heightened risk of exploitation due to past and threatened nation-state attacks and disclosures."

Impact

While no current exploit is known, the University Information Security Office (UISO) believes there is a greater chance of one being developed rapidly and released into the wild. To prevent the spread of such an exploit, patching outside of normal patch schedules is required. In addition, UISO stands ready to take necessary actions to mitigate significant institutional risk that such an exploit might create. Necessary actions may include blocking vulnerable, but not yet compromised, devices from Indiana University's networks.

Platforms

All versions of Windows are impacted, including out-of-date operating systems like Windows XP and Windows 2003.

Local observations

UISO has seen worm activity from similar Microsoft Server Message Block 1.0 (SMBv1) vulnerabilities like MS17-010.

UISO recommendations

UISO urges that these security patches be applied as soon as possible. Additionally, systems should be configured for automatic management of security updates.

Further reading

No workarounds are recommended. Please patch immediately.

• https://support.microsoft.com/en-us/help/4025686/microsoft-security-advisory-4025685-guidance-for-supported-platforms
• https://support.microsoft.com/en-us/help/4025687/microsoft-security-advisory-4025685-guidance-for-older-platforms
• https://kb.iu.edu/d/arlc
• https://support.microsoft.com/en-US/help/306525/how-to-configure-and-use-automatic-updates-in-windows
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8589
• https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8589