Patch Tuesday 06/09/2020 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities

Details

Microsoft's Patch Tuesday update for June 2020 contained 132 vulnerabilities in total, with:

6 vulnerability rated as Critical
88 vulnerabilities rated as High
36 vulnerabilities rated as Medium
2 vulnerabilities rated as Low

Critical vulnerabilities

The most notable critical-rated vulnerabilities are tracked as CVE-2020-1331 and CVE-2020-9633.

CVE-2020-1331

CVE-2020-1331 is a spoofing vulnerability impacting Microsoft System Center 2016 Operations Manager. According to Microsoft, the vulnerability exists when System Center Operations Manager (SCOM) does not properly sanitize a specially crafted web request to an affected SCOM instance. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SCOM instance. The attacker who successfully exploits the vulnerability could then perform cross-site scripting attacks on affected systems and run the script in the security context of the current user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SCOM instance on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.

CVE-2020-1331

CVE-2020-1331 is an arbitrary code execution vulnerability in Adobe Flash Player affecting Microsoft Windows. Successful exploitation of this vulnerability could result in an attacker executing arbitrary code in the context of the affected application. Depending on the privileges associated with this application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of this vulnerability could have less impact than if it was configured with administrative rights.

High-severity vulnerabilities

The most notable high-severity vulnerabilities are tracked as CVE-2020-1206, CVE-2020-1284, and CVE-2020-1301 which affects the Microsoft Windows SMB (Server Message Block) and Microsoft Windows SMBv3 Client/Server.

CVE-2020-1206

An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. According to Microsoft, an attacker who successfully exploits the vulnerability could obtain information to further compromise the user’s system. To exploit the vulnerability against a server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 server. To exploit the vulnerability against a client, an unauthenticated attacker would need to configure a malicious SMBv3 server and convince a user to connect to it. This vulnerability impacts the following Microsoft products:

Windows Server version 1903 (Server Core installation)
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows Server version 2004 (Server Core installation)
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server version 1909 (Server Core installation)
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems

Proof-of-concept to exploit this vulnerability has been provided to Microsoft. The most recent Microsoft security update corrects how the SMBv3 protocol handles these specially crafted requests.

CVE-2020-1284

A denial of service vulnerability that exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. According to Microsoft, an authenticated attacker who successfully exploited this vulnerability against an SMB Server could cause the affected system to crash. An unauthenticated attacker could also exploit this vulnerability against an SMB client and cause the affected system to crash. To exploit the vulnerability against a server, an authenticated attacker could send a specially crafted packet to a targeted SMBv3 server. To exploit the vulnerability against a client, an unauthenticated attacker would need to configure a malicious SMBv3 server and convince a user to connect to it. This vulnerability impacts the following Microsoft products:

Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows Server version 2004 (Server Core installation)
Windows 10 Version 2004 for 32-bit Systems

The most recent Microsoft security update corrects how the SMBv3 protocol handles these specially crafted requests, for both vulnerabilities.

CVE-2020-1301

A remote code execution vulnerability exists in the way the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. According to Microsoft, an attacker who successfully exploits the vulnerability could gain the ability to execute code on the target server. To exploit the vulnerability, in most situations, an authenticated attacker could send a specially crafted packet to a targeted SMBv1 server. This vulnerability impacts the following Microsoft products:

Windows 10 Version 1803 for x64-based Systems
Windows Server version 1903 (Server Core installation)
Windows Server 2012 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2012 R2 (Server Core installation)
Windows 10 Version 1709 for ARM64-based Systems
Windows Server version 2004 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2012
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows 10 Version 2004 for x64-based Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 10 Version 1809 for x64-based Systems
Windows 10 for 32-bit Systems
Windows Server 2019
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1709 for 32-bit Systems
Windows Server version 1803 (Server Core Installation)
Windows Server 2016 (Server Core installation)
Windows Server 2019 (Server Core installation)
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 10 Version 1903 for ARM64-based Systems
Windows Server 2012 R2
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows 10 Version 2004 for ARM64-based Systems
Windows Server 2008 for Itanium-Based Systems Service Pack 2
Windows 10 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server version 1909 (Server Core installation)
Windows Server 2016
Windows 8.1 for x64-based systems
Windows RT 8.1

Proof-of-concept to exploit this vulnerability has been provided to Microsoft. The most recent security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.

Office vulnerabilities

Microsoft Office and Excel have also received several updates on the Patch Tuesday update. The most notable among them are CVE-2020-1225 and CVE-2020-1226, which could allow remote code execution in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploits the vulnerability could run arbitrary code in the context of the current user. CVE-2020-1229 is yet another security bypass vulnerability that exists in Microsoft Outlook when Office fails to enforce security settings configured on a system. An attacker who successfully exploits this vulnerability could cause a system to load remote images. These images could disclose the IP address of the targeted system to the attacker.

Users are advised to apply the latest security patches specified in Microsoft's Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.