Patch Tuesday 11/12/2020 Notes

Patch Tuesday Notes 11/11/2020

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities

Details

Highlights:

Microsoft's Patch Tuesday update for November 2020 contained 112 vulnerabilities in total, with:

1 vulnerability rated as Critical
67 vulnerabilities rated as High
43 vulnerabilities rated as Medium
1 vulnerability rated as Low

Critical vulnerabilities

The most notable critical-rated vulnerability is tracked as CVE-2020-17051.

CVE-2020-17051

CVE-2020-17051 is a remote code execution vulnerability in Windows Network File System. Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Network File System component. By persuading a victim to open a specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The November Microsoft Patch Tuesday Update contains a zero-day tracked as CVE-2020-17087. CVE-2020-17087 was publicly disclosed by the Google Project Zero and TAG security teams on October 30, 2020. According to Google, the vulnerability is already seeing active exploitation. As of 12 November 2020, a PoC to for the vulnerability is located on Github at https://github.com/TinToSer/CVE2020-17087.

The following products are affected by CVE-2020-17051:

Windows 10 Version 1903 for ARM64-based Systems
Windows Server 2016
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 2004 for x64-based Systems
Windows Server version 1909 (Server Core installation)
Windows Server version 2004 (Server Core installation)
Windows 8.1 for 32-bit systems
Windows 10 Version 1809 for ARM64-based Systems
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows 7 for 32-bit Systems Service Pack 1
Windows 10 Version 1903 for 32-bit Systems
Windows 8.1 for x64-based systems
Windows Server 2012
Windows Server 2016 (Server Core installation)
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server version 1903 (Server Core installation)
Windows Server version 20H2 (Server Core Installation)
Windows 10 Version 2004 for ARM64-based Systems
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2019
Windows Server 2012 R2 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2019 (Server Core installation)
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows RT 8.1
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

High-severity vulnerabilities

The most notable high-severity vulnerabilities are tracked as CVE-2020-17087, CVE-2020-16970, CVE-2020-17084, CVE-2020-17016, CVE-2020-17061, and CVE-2020-17042.

CVE-2020-17087

CVE-2020-17087 is a privilege escalation vulnerability that exists in Microsoft Windows. Microsoft Windows could allow a locally authenticated attacker to gain elevated privileges on the system, caused by a pool-based buffer overflow in the Kernel Cryptography Driver (cng.sys). By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges.