Microsoft Patch Tuesday for July 2020 — Snort rules and prominent vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-1350 | Wormable Unauthenticated RCE in Microsoft Windows DNS Server CVE-2020-1350 is a critical (CVSS 10.0) remote code execution vulnerability in the DNS Server role of Microsoft Windows Server, caused by improper input handling (CWE-20) when the server fails to properly process crafted DNS requests, notably malicious DNS signature (SIG) records delivered over TCP. An unauthenticated attacker can trigger it by sending a crafted DNS query that forces the vulnerable DNS server to perform an upstream lookup and receive a malicious response, overflowing a heap buffer. Successful exploitation yields code execution with SYSTEM privileges on the DNS server, which is very often an Active Directory domain controller, giving the attacker control of the host and typically the entire domain; the flaw is considered wormable because compromised DNS servers can propagate attacks to other servers they query. Any Windows Server 2008, 2012, 2016, or 2019 host running the DNS Server role is affected — internet-facing DNS servers are directly explovable, while internal DNS servers can be reached via malicious DNS responses passed through firewalls. The flaw was fixed in Microsoft's July 2020 updates, is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, required action: apply vendor updates), carries EPSS of 91.4% (100th percentile), and appears in the NSA's top-25 list of flaws exploited by Chinese state-sponsored hackers; no public PoC is cataloged in this dataset and ransomware use is listed as unknown. Do: Apply the July 2020 (or later) Microsoft security updates for each affected Windows Server release, prioritizing internet-facing DNS servers and domain controllers; if patching must be delayed, apply Microsoft's registry-based workaround limiting TCP DNS packet size (TcpReceivePacketSize = 0xFF00) and restart the DNS Server service. Inventory hosts with the DNS Server role installed and review their TCP/53 exposure, especially any resolvers reachable from the internet, and confirm remediation per CISA's required action. | 10.0 | 91% | KEV |
| masshundreds of thousands of internet-exposed Windows DNS servers (est.), with millions of total deployments including internal domain controllers |
Full article464 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, July 14, 2020 14:01
Microsoft released its monthly security update Tuesday, disclosing more than 120 vulnerabilities across its array of products.
While only a few vulnerabilities are considered critical, users of all Microsoft and Windows products are urged to update their software as soon as possible to avoid possible exploitation.
The security updates cover several different products including the Hyper-V engine, Microsoft Word and the rest of the Microsoft Office suite of products.
Talos also released a new set of SNORTⓇ rules that provide coverage for some of these vulnerabilities. For complete details, check out the latest Snort advisory here.
Cisco Talos discovered six of the critical vulnerabilities that Microsoft fixed this month, all of which could allow an adversary to execute remote code by exploiting the RemoteFX feature in the Windows Hyper-V engine. These bugs affect some Intel and AMD drivers.
It is likely that an attacker could use these vulnerabilities to exploit users remotely. They could also be used to escape out of a Hyper-V virtual machine to access the host machine. We could not use the vulnerabilities to escape out of a VMware virtual machine. Microsoft elected to disable RemoteFX in Hyper-V to resolve these issues. For more information, check out our full Vulnerability Spotlight here.
The other critical bug we want to specifically highlight is CVE-2020-1350, a remote code execution vulnerability in the Windows DNS server. This vulnerability was assigned a base CVSS score of 10, the highest possible, showing just how dangerous exploitation of it could be. DNS is one of the core components of networking, so any potential attack could cause major disruptions. Due to the possibility that this vulnerability could be exploited in a self-replicating way, we urge users to patch immediately.
An adversary could exploit CVE-2020-1350 by sending malicious requests to a Windows DNS server, allowing them to run arbitrary code in the context of the Local System Account. Windows servers configured as DNS servers are vulnerable to this type of exploitation.
Most of the other vulnerabilities in this month’s Patch Tuesday are considered important. Visit Microsoft’s update page for complete details.
In response to these vulnerability disclosures, Talos is releasing a new SNORTⓇ rule set that detects attempts to exploit some of them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.
The rules included in this release that protect against the exploitation of many of these vulnerabilities are 54509 - 54511, 54516 - 54518, 54521 - 54525, 54534, 54535.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/microsoft-patch-tuesday-for-july-2020/