Patch Tuesday 08/11/2020 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities

Details

Microsoft's Patch Tuesday update for August 2020 contained 120 vulnerabilities in total, with:

2 vulnerabilities rated as Critical
91 vulnerabilities rated as High
27 vulnerabilities rated as Medium

Critical vulnerabilities

The most notable critical-rated vulnerabilities in Microsoft's Patch Tuesday Update are tracked as CVE-2020-1476 and CVE-2020-1472.

CVE-2020-1472

CVE-2020-1472 is an elevation of privilege bug impacting Microsoft’s Netlogon Remote Protocol. According to Microsoft, the vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.

Proof-of-concept to exploit this vulnerability is available. Microsoft is addressing the vulnerability in a phased two-part rollout. The most recent Microsoft update modifies how Netlogon handles the usage of Netlogon secure channels.

CVE-2020-1476

CVE-2020-1476 is an elevation of privilege vulnerability impacting Microsoft .NET Framework. According to Microsoft, the vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files. An attacker who successfully exploited this vulnerability could gain access to restricted files. To exploit this vulnerability, an attacker would need to send a specially crafted request to an affected server.

The most recent Microsoft security update changes how ASP.NET and .NET handle requests.

Zero-day vulnerabilities

Microsoft has patched two zero-day vulnerabilities tracked as CVE-2020-1464 and CVE-2020-1380, that are being actively exploited in the wild.

CVE-2020-1464

CVE-2020-1464 is a spoofing vulnerability impacting Windows. According to Microsoft, the vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files. In an attack scenario, an attacker could bypass security features intended to prevent improperly signed files from being loaded. While this is being actively exploited in the wild, at this time there are few public details on the vulnerability. The most recent Microsoft update corrects how Windows validates file signatures.

CVE-2020-1380

CVE-2020-1380 is a remote code execution vulnerability impacting Internet Explorer. According to Microsoft, the vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. It could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability. Microsoft’s release states that CVE-2020-1380 has been exploited in the wild, though no proof-of-concept code is publicly available. The most recent Microsoft security update modifies how the scripting engine handles objects in memory.

High-severity vulnerabilities

The most notable high-severity vulnerabilities are tracked as CVE-2020-1379, CVE-2020-1477, CVE-2020-1492, CVE-2020-1525, CVE-2020-1554. The bugs could allow an adversary to corrupt memory in a way that would allow them to execute code remotely on the victim machine. Any of these vulnerabilities could be triggered if the target opens a specially crafted document or web page. The most recent Microsoft security update corrects how Windows Media Foundation handles objects in memory.

Two other high-rated vulnerabilities are tracked as CVE-2020-1555 and CVE-2020-1337.

CVE-2020-1555

CVE-2020-1555 is a remote code execution vulnerability impacting Microsoft Edge. According to Microsoft, the vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). It could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability. The most recent Microsoft security update modifies how the scripting engine handles objects in memory.

CVE-2020-1337

CVE-2020-1337 is an elevation of privilege vulnerability impacting Windows. According to Microsoft, the vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application.

Proof-of-concept to exploit this vulnerability is available. The most recent Microsoft update corrects how the Windows Print Spooler Component writes to the file system.

Users are advised to apply the latest security patches specified in Microsoft's Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.