Patch Tuesday 09/09/2020 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information
Be sure to apply patches promptly to mitigate these and other vulnerabilities

Details

Microsoft's Patch Tuesday update for September 2020 contained 129 vulnerabilities in total, with:

3 vulnerabilities rated as Critical
68 vulnerabilities rated as High
58 vulnerabilities rated as Medium

Critical vulnerabilities

The most notable critical-rated vulnerabilities are tracked as CVE-2020-16875, CVE-2020-1210, and CVE-2020-1595.

CVE-2020-16875 CVE-2020-16875 is a Memory Corruption Vulnerability impacting Microsoft Exchange. According to Microsoft, the memory corruption vulnerability is a result of a remote code execution vulnerability that exists in Microsoft Exchange software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. An attacker could then install programs; view, change, or delete data; or create new accounts. The exploitation of the vulnerability requires that a specially crafted email be sent to a vulnerable Exchange server. The following products are affected by CVE-2020-16875:

Microsoft Exchange Server 2016 Cumulative Update 16
Microsoft Exchange Server 2016 Cumulative Update 17
Microsoft Exchange Server 2019 Cumulative Update 5
Microsoft Exchange Server 2019 Cumulative Update 6

Microsoft’s security update addresses the vulnerability by correcting how Microsoft Exchange handles objects in memory.

CVE-2020-1210 CVE-2020-1210 is a Remote Code Execution Vulnerability affecting Microsoft SharePoint. According to Microsoft, the vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. The exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. CVE-2020-1210 is reminiscent of CVE-2019-0604, another remote code execution vulnerability that exists in Microsoft SharePoint when the software fails to check the source markup of an application package. The following products are affected by CVE-2020-1210:

Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Server 2010 Service Pack 2
Microsoft SharePoint Server 2019

Microsoft’s security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.

CVE-2020-1595 CVE-2020-1595 is also a Remote Code Execution Vulnerability residing in Microsoft SharePoint. According to Microsoft, the vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. The exploitation of this vulnerability requires that a user access a susceptible API on an affected version of SharePoint with specially-formatted input. The following products are affected by CVE-2020-1595:

Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft SharePoint Server 2019

Microsoft’s security update addresses the vulnerability by correcting how SharePoint handles the deserialization of untrusted data.

High-severity vulnerabilities

The most notable high-severity vulnerabilities are tracked as CVE-2020-0922 and CVE-2020-0908 which affects the Microsoft COM for Windows and Windows Text Service Module.

CVE-2020-0922 CVE-2020-0922 is a Remote Code Execution Vulnerability impacting Microsoft COM for Windows. According to Microsoft, the remote code execution vulnerability exists in the way that Microsoft COM for Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code on a target system. To exploit the vulnerability, a user would have to open a specially crafted file or lure the target to a website hosting malicious JavaScript. This vulnerability affects the following Microsoft products:

Windows 10 Version 1809 for 32-bit Systems
Windows 7 for x64-based Systems Service Pack 1
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 8.1 for x64-based systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1903 for 32-bit Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2012 R2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2012
Windows 10 Version 1709 for ARM64-based Systems
Windows Server 2019 (Server Core installation)
Windows Server version 1903 (Server Core installation)
Windows 8.1 for 32-bit systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1903 for x64-based Systems
Windows Server version 2004 (Server Core installation)
Windows Server 2012 R2
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows Server version 1909 (Server Core installation)
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2012 (Server Core installation)
Windows Server 2016 (Server Core installation)
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows RT 8.1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 10 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows Server 2016
Windows 10 Version 1709 for 32-bit Systems
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows 10 Version 1909 for x64-based Systems

Microsoft’s latest security update addresses the vulnerability by correcting how Microsoft COM for Windows handles objects in memory.

CVE-2020-0908 CVE-2020-0908 is a Remote Code Execution Vulnerability affecting Windows Text Service Module. According to Microsoft, the remote code execution vulnerability exists when the Windows Text Service Module improperly handles memory. An attacker who successfully exploited the vulnerability would gain execution on a victim system. This vulnerability impacts the following Microsoft products:

Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1709 for ARM64-based Systems
Windows Server 2019 (Server Core installation)
Windows Server version 1903 (Server Core installation)
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1903 for x64-based Systems
Windows Server version 2004 (Server Core installation)
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows Server version 1909 (Server Core installation)
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows Server 2016 (Server Core installation)
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows Server 2016
Windows 10 Version 1709 for 32-bit Systems
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems

Microsoft’s latest security update addresses the vulnerability by correcting how the Windows Text Service Module handles memory.

Other Microsoft Vulnerabilities Other notable Microsoft vulnerabilities are remote code execution vulnerabilities tracked as CVE-2020-16857, CVE-2020-16862, CVE-2020-1285, CVE-2020-1210, CVE-2020-1200, CVE-2020-1576, CVE-2020-1452, CVE-2020-1453, and CVE-2020-1460, impacting Microsoft Dynamics 365 for Finance and Operations (on-premises), Microsoft Dynamics 365 (on-premises), GDI+, Microsoft SharePoint, Windows Media Audio Decoder, Windows, Windows Codecs Library, Windows Camera Codec Pack, and Visual Studio. CVE-2020-0878, CVE-2020-1057, and CVE-2020-1172 are memory corruption vulnerabilities impacting Microsoft Browser and Scripting Engine.

The latest Microsoft Security Update did not contain any zero-days and, as of now, there are no vulnerabilities found to be exploited in the wild.

Users are advised to apply the latest security patches specified in Microsoft's Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.