Microsoft August 2020 Patch Tuesday fixed actively exploited zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-1380 | Memory Corruption RCE in Microsoft Internet Explorer Scripting Engine CVE-2020-1380 is a memory corruption vulnerability (an out-of-bounds write, CWE-787) in the Microsoft Internet Explorer scripting engine that can corrupt memory when the engine processes maliciously crafted script content. It is triggered by luring a user to visit an attacker-controlled or compromised web page in Internet Explorer or in an application that invokes the IE engine, with no authentication required. Successful exploitation allows the attacker to execute arbitrary code in the context of the current user, gaining that user's privileges on the system. All installations of the affected Microsoft Internet Explorer versions are potentially exposed, with the greatest risk to legacy and enterprise Windows systems that still browse or render content with IE. The flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating exploitation in the wild, while no public proof-of-concept is known and ransomware use is unconfirmed. Do: Apply Microsoft's June 2020 (or later) Windows cumulative security updates on every system running Internet Explorer, per the vendor instructions cited by CISA. Given the KEV listing (added 2021-11-03) and high EPSS (~24% 30-day exploitation probability, 98th percentile), treat this as a priority patch. Reduce attack surface by steering users to Microsoft Edge instead of IE for web browsing and auditing internal apps or legacy sites that still invoke the IE engine to render external content. | 7.8 | 24% | KEV |
| masshundreds of millions of Windows devices historically able to run Internet Explorer; exact currently-vulnerable count unknown | |
| CVE-2020-1464 | File Signature Validation Spoofing in Microsoft Windows CVE-2020-1464 is a spoofing vulnerability in Microsoft Windows caused by improper validation of file digital signatures (CWE-347). It is triggered when Windows accepts a file whose signature is malformed or improperly formed, treating it as validly signed. An attacker who can introduce such a file onto a system can bypass security features that depend on signature verification, allowing improperly signed files to load as if trusted — a common technique for malware delivery and defense evasion. Essentially all Microsoft Windows deployments on affected versions are exposed until patched. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), confirming exploitation in the wild, though no public proof-of-concept is known and any ransomware linkage is unconfirmed. Do: Apply Microsoft's security updates for CVE-2020-1464 on all Windows systems per vendor instructions, prioritizing internet-facing and high-value endpoints, and verify patch coverage fleet-wide given the CISA KEV listing. Until patched, avoid relying solely on digital-signature-based trust decisions (e.g., application allowlisting or signature-gated file loading) for files of unknown origin. | 7.8 | 39% | KEV PoC |
| mass≈1 billion+ Windows devices worldwide (essentially all unpatched Windows installations) |
Full article463 words · extracted from securityaffairs.com · click to collapse
Microsoft August 2020 Patch Tuesday updates addressed 120 vulnerabilities, including two zero-days that have been exploited in attacks.
Microsoft August 2020 Patch Tuesday updates have addressed 120 flaws, including two zero-day vulnerabilities that have been exploited in attacks in the wild.
The two issues are a Windows spoofing bug and a remote code execution flaw in Internet Explorer.
The Windows spoofing flaw, tracked as CVE-2020-1464 can be exploited by an attacker to bypass security features and load improperly signed files. The flaw is related to Windows incorrectly validating file signatures.
“A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files.” reads the advisory published by Microsoft.
“In an attack scenario, an attacker could bypass security features intended to prevent improperly signed files from being loaded.”
The flaw affects many Windows OSs, including Windows 7 and Windows Server 2008, for which the IT giant will not provide security updates because the reached the end-of-life.
Microsoft confirmed that threat actors are actively exploiting the issues in attacks against Windows systems but it did not provide technical details about the attacks.
The second zero-day addressed by Microsoft is tracked as CVE-2020-1380, it is a remote code execution issue that affects the scripting engine used by Internet Explorer. The flaw is related to the way the engine handles objects in memory, it could be exploited by tricking victims into visiting a malicious website, or by opening a malicious Office document, or through a malvertising attack.
“A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.” reads the advisory. “An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system.”
The RCE vulnerability was discovered by security researchers at Kaspersky.
Microsoft also addressed other 15 critical vulnerabilities that impact Windows, the Edge and Internet Explorer browsers, Outlook, and the .NET framework. Most of the vulnerabilities are remote code execution issues.
Microsoft August 2020 Patch Tuesday also fixed over 100 vulnerabilities, rated as important, impacting Windows, Dynamics 365, Office, Outlook, SharePoint, and Visual Studio Code. These flaws can be exploited for remote code execution, privilege escalation, XSS attacks, DoS attacks, and to disclose information.
The full list of flaws addressed by Microsoft August 2020 Patch Tuesday is available here.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Microsoft August 2020 Patch Tuesday)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/107034/breaking-news/microsoft-august-2020-patch-tuesday.html