Patch Tuesday 12/09/2020 Notes

Microsoft Patch Tuesday 12/9/2020 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities

Details

Highlights:

Microsoft's Patch Tuesday update for December 2020 contained 58 vulnerabilities in total, with:

• 2 vulnerabilities rated as Critical
• 40 vulnerabilities rated as High
• 15 vulnerabilities rated as Medium
• 1 vulnerability rated as Low

According to Microsoft, for CVE-2020-17132(Critical), CVE-2020-17142(Critical), CVE-2020-17118(High), CVE-2020-17089(High), CVE-2020-17119(Medium) and CVE-2020-17117(Medium), proof-of-concepts have been identified. However, they are currently not disclosed publicly.

Critical vulnerabilities

The most notable critical-rated vulnerabilities are tracked as CVE-2020-17132 and CVE-2020-17142. Both critical vulnerabilities have received a severity score of 9.1 (CVSS v3).

CVE-2020-17132 CVE-2020-17132 is a remote code execution (RCE) vulnerability in Microsoft Exchange. Microsoft Exchange Server could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper validation of cmdlet arguments. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.

The following products are impacted by CVE-2020-17132:

• Microsoft Exchange Server 2013 Cumulative Update 23
• Microsoft Exchange Server 2016 Cumulative Update 18
• Microsoft Exchange Server 2019 Cumulative Update 7
• Microsoft Exchange Server 2019 Cumulative Update 6
• Microsoft Exchange Server 2016 Cumulative Update 17

CVE-2020-17142 CVE-2020-17142 is also a remote code execution vulnerability in Microsoft Exchange. Microsoft Exchange Server could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper validation of cmdlet arguments. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.

The following products are impacted by CVE-2020-17142:

• Microsoft Exchange Server 2013 Cumulative Update 23
• Microsoft Exchange Server 2016 Cumulative Update 18
• Microsoft Exchange Server 2019 Cumulative Update 7
• Microsoft Exchange Server 2019 Cumulative Update 6
• Microsoft Exchange Server 2016 Cumulative Update 17

High-severity vulnerabilities

The most notable high-severity vulnerabilities are tracked as CVE-2020-17143, CVE-2020-17144, CVE-2020-17141, CVE-2020-17118, and CVE-2020-17121.

CVE-2020-17143 CVE-2020-17143 is an information disclosure vulnerability in Microsoft Exchange. Microsoft. Exchange Server could allow a remote authenticated attacker to obtain sensitive information. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.

The following products are impacted by CVE-2020-17143:

• Microsoft Exchange Server 2016 Cumulative Update 18
• Microsoft Exchange Server 2013 Cumulative Update 23
• Microsoft Exchange Server 2019 Cumulative Update 7
• Microsoft Exchange Server 2019 Cumulative Update 6
• Microsoft Exchange Server 2016 Cumulative Update 17

CVE-2020-17144 CVE-2020-17144 is a remote code execution vulnerability in Microsoft Exchange. Microsoft Exchange Server could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper validation of cmdlet arguments. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.

The following product is impacted by CVE-2020-17144:

Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 31

CVE-2020-17141 CVE-2020-17141 is also a remote code execution vulnerability in Microsoft Exchange. Microsoft Exchange Server could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper validation of cmdlet arguments. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.

The following products are impacted by CVE-2020-17141:

• Microsoft Exchange Server 2016 Cumulative Update 18
• Microsoft Exchange Server 2019 Cumulative Update 6
• Microsoft Exchange Server 2019 Cumulative Update 7
• Microsoft Exchange Server 2016 Cumulative Update 17

CVE-2020-17118 CVE-2020-17118 is a remote code execution vulnerability in Microsoft SharePoint. Microsoft SharePoint could allow a remote attacker to execute arbitrary code on the system.

The following products are impacted by CVE-2020-17118:

• Microsoft SharePoint Server 2019
• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Foundation 2010 Service Pack 2
• Microsoft SharePoint Foundation 2013 Service Pack 1

CVE-2020-17121 CVE-2020-17121 is also a remote code execution vulnerability in Microsoft SharePoint. Microsoft SharePoint could allow a remote authenticated attacker to execute arbitrary code on the system. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted by CVE-2020-17121:

• Microsoft SharePoint Foundation 2013 Service Pack 1
• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Foundation 2010 Service Pack 2
• Microsoft SharePoint Server 2019

Other Microsoft Vulnerabilities

Other notable Microsoft vulnerabilities include CVE-2020-17095, a remote code execution vulnerability in Hyper-V, which could allow a remote authenticated attacker to execute arbitrary code on the system. By executing a specially-crafted program on a Hyper-V guest, an attacker could exploit this vulnerability to execute arbitrary code on the host operating system. CVE-2020-17145 and CVE-2020-17135 are spoofing vulnerabilities in Azure DevOps Server and Team Foundation Services, which could allow a remote authenticated attacker to conduct spoofing attacks. CVE-2020-17002 and CVE-2020-16971 are security feature bypass vulnerabilities in Azure SDK for C Security and Java Security, an attacker could exploit these vulnerabilities to bypass security features in order to gain access to the system.

Users are advised to apply the latest security patches specified in Microsoft's November Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.