Patch Tuesday 07/15/2020 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities

Details

Microsoft's Patch Tuesday update for July 2020 contained 123 vulnerabilities in total, with:

4 vulnerabilities rated as Critical
89 vulnerabilities rated as High
30 vulnerabilities rated as Medium

Critical vulnerabilities

The most notable critical-rated vulnerabilities in Microsoft's Patch Tuesday Update are tracked as CVE-2020-1350, CVE-2020-1147, CVE-2020-1439, and CVE-2020-1444.

CVE-2020-1350 CVE-2020-1350 is a Remote Code Execution Vulnerability impacting Windows DNS Server. According to Microsoft, the vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account. Windows servers that are configured as DNS servers are at risk from this vulnerability. To exploit the vulnerability, an unauthenticated attacker could send malicious requests to a Windows DNS server. The vulnerability is assigned a CVSS Base Score 10 and affects the following Microsoft products:

Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2012 Windows Server 2012 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows Server 2016 Windows Server 2016 (Server Core installation) Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server, version 1903 (Server Core installation) Windows Server, version 1909 (Server Core installation) Windows Server, version 2004 (Server Core installation)

Proof-of-concept to exploit this vulnerability is available. The most recent Microsoft security update addresses the vulnerability by modifying how Windows DNS servers handle requests.

CVE-2020-1147 CVE-2020-1147 is also a Remote Code Execution Vulnerability impacting Microsoft .NET Framework, SharePoint Server, and Visual Studio. According to Microsoft, the vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the process responsible for deserialization of the XML content. To exploit this vulnerability, an attacker could upload a specially crafted document to a server utilizing an affected product to process content.

CVE-2020-1439 CVE-2020-1439 is a Remote Code Execution Vulnerability impacting Microsoft PerformancePoint Services for SharePoint Server. According to Microsoft, the vulnerability exists when the software fails to check the source markup of XML file input. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the process responsible for deserialization of the XML content. To exploit this vulnerability, an attacker could upload a specially crafted document to a server utilizing an affected product to process content.

CVE-2020-1444 CVE-2020-1444 is a Remote Code Execution Vulnerability impacting Microsoft SharePoint. According to Microsoft, the vulnerability exists when the software parses specially crafted email messages. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the system user. An attacker could then install programs; view, change, add, or delete data. To exploit this vulnerability, an attacker would need to send a specially crafted email to an affected SharePoint server, and then convince the recipient to perform multiple actions while replying to the message.

High-severity vulnerabilities

Among the 89 high-severity rated vulnerabilities, the most notable high-severity vulnerabilities are tracked as CVE-2020-1041, CVE-2020-1040, CVE-2020-1032, CVE-2020-1036, CVE-2020-1042, CVE-2020-1043 which affects the Microsoft Hyper-V RemoteFX vGPU. These six Hyper-V vulnerabilities could allow an attacker on a guest operating system to execute commands on the host. To exploit these vulnerabilities, an attacker could run a specially crafted application on a guest operating system, attacking certain third-party video drivers running on the Hyper-V host. This could then cause the host operating system to execute arbitrary code.

An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system. This vulnerability impacts the following Microsoft products: Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2016 Windows Server 2012 R2 (Server Core installation) Windows Server 2012 (Server Core installation) Windows Server 2012 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2016 (Server Core installation) Windows Server 2012 R2

There is no patch to fix this vulnerability, and the update provided by Microsoft Patch Tuesday Update will forcibly disable RemoteFX when applied.

Office vulnerabilities Microsoft Office has also received several updates on the Patch Tuesday Update. The most notable among them are CVE-2020-1458 and CVE-2020-1025. CVE-2020-1458 could allow remote code execution when Microsoft Office improperly validates input before loading dynamic link library (DLL) files. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. CVE-2020-1025 is an elevation of privilege vulnerability that exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper access.

Windows vulnerabilities Along with CVE-2020-1350, which has been assigned with a CVSS score 10, Microsoft Windows has received multiple patches included in its July Patch Tuesday Update. The Most notable ones among many are CVE-2020-1436, CVE-2020-1410 and CVE-2020-1463. CVE-2020-1436 is a remote code execution vulnerability impacting the Windows font library. CVE-2020-1410 is also a remote code execution vulnerability that exists when vcard files in Windows Address Book (WAB) are improperly processed. CVE-2020-1463 is an elevation of privilege vulnerability that exists in the way that the SharedStream Library handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.

Users are advised to apply the latest security patches specified in Microsoft's Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.