July 2020 Patch Tuesday: Microsoft plugs wormable Windows DNS Server RCE flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-1147 | XML Markup RCE in Microsoft .NET Framework, SharePoint, and Visual Studio CVE-2020-1147 is a remote code execution flaw that exists in Microsoft .NET Framework, .NET Core, SharePoint Enterprise Server, SharePoint Server, Visual Studio 2017, and Visual Studio 2019 when the software fails to check the source markup of XML file input. It is triggered when an application parses attacker-controlled XML — public proofs-of-concept demonstrate exploitation through SharePoint's DataSet/DataTable deserialization, allowing an attacker to run arbitrary code in the context of the affected application or service. An attacker who successfully exploits the flaw gains code execution with the privileges of the parsing process, which on SharePoint servers typically means compromise of a widely used business platform. Organizations running affected .NET Framework, .NET Core, SharePoint, or Visual Studio deployments are affected. Exploitation is confirmed: public PoCs were released around the July 2020 Patch Tuesday fixes, the flaw was added to CISA's Known Exploited Vulnerabilities catalog in November 2021, and news reports describe the Storm-2603 group deploying ransomware on exploited SharePoint servers. Do: Apply the July 2020 Microsoft security updates for .NET Framework, .NET Core, SharePoint, and Visual Studio, as required by CISA's KEV catalog entry. Prioritize internet-facing SharePoint servers, and hunt for signs of exploitation there given reports of Storm-2603 deploying ransomware on exploited SharePoint servers. Until patched, restrict untrusted XML input handling and limit exposure of SharePoint and other affected services to the internet. | 7.8 | 94% | KEV PoC ×4 |
| masshundreds of millions of Windows devices with .NET Framework installed, plus tens of thousands of SharePoint deployments (order of magnitude estimate) | |
| CVE-2020-1349 | A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka 'Microsoft Outlook Remote Cod A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka 'Microsoft Outlook Remote Code Execution Vulnerability'. NVD description · AI analysis pending | 7.8 | 22% |
| — | ||
| CVE-2020-1350 | Wormable Unauthenticated RCE in Microsoft Windows DNS Server CVE-2020-1350 is a critical (CVSS 10.0) remote code execution vulnerability in the DNS Server role of Microsoft Windows Server, caused by improper input handling (CWE-20) when the server fails to properly process crafted DNS requests, notably malicious DNS signature (SIG) records delivered over TCP. An unauthenticated attacker can trigger it by sending a crafted DNS query that forces the vulnerable DNS server to perform an upstream lookup and receive a malicious response, overflowing a heap buffer. Successful exploitation yields code execution with SYSTEM privileges on the DNS server, which is very often an Active Directory domain controller, giving the attacker control of the host and typically the entire domain; the flaw is considered wormable because compromised DNS servers can propagate attacks to other servers they query. Any Windows Server 2008, 2012, 2016, or 2019 host running the DNS Server role is affected — internet-facing DNS servers are directly explovable, while internal DNS servers can be reached via malicious DNS responses passed through firewalls. The flaw was fixed in Microsoft's July 2020 updates, is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, required action: apply vendor updates), carries EPSS of 91.4% (100th percentile), and appears in the NSA's top-25 list of flaws exploited by Chinese state-sponsored hackers; no public PoC is cataloged in this dataset and ransomware use is listed as unknown. Do: Apply the July 2020 (or later) Microsoft security updates for each affected Windows Server release, prioritizing internet-facing DNS servers and domain controllers; if patching must be delayed, apply Microsoft's registry-based workaround limiting TCP DNS packet size (TcpReceivePacketSize = 0xFF00) and restart the DNS Server service. Inventory hosts with the DNS Server role installed and review their TCP/53 exposure, especially any resolvers reachable from the internet, and confirm remediation per CISA's required action. | 10.0 | 91% | KEV |
| masshundreds of thousands of internet-exposed Windows DNS servers (est.), with millions of total deployments including internal domain controllers | |
| CVE-2020-1421 +1 in the same advisory: …1374 | A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfull A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user, aka 'LNK Remote Code Execution Vulnerability'. NVD description · AI analysis pending | 8.8 group max | 75% |
| — |
Full article934 words · extracted from helpnetsecurity.com · click to collapse
On this July 2020 Patch Tuesday, Microsoft has plugged 18 critical and 105 high-severity flaws, Adobe has delivered security updates for ColdFusion, Adobe Genuine Service, Adobe Download Manager, Adobe Media Encoder and Adobe Creative Cloud Desktop Application, and Oracle is set to deliver fixes for 433 vulnerabilities.
Microsoft’s updates
For the fifth month in a row, Microsoft has fixed over 100 CVE-numbered vulnerabilities: 123, to be precise.
First and foremost, one of the fixed vulnerabilities has been especially singled out: CVE-2020-1350, aka SIGRed, a “wormable” remote code execution flaw in the Windows DNS Server service that affects all Windows Server versions.
The vulnerability could be exploited to achieve unauthenticated code execution at the level of Local System account on an affected system by sending a specially crafted request.
“That makes this bug wormable – at least between affected DNS servers. Microsoft also suggests a registry edit that limits the size of TCP packets the server will process as a workaround, but they don’t list any potential side effects of that registry change. The attack vector requires very large DNS packets, so attacks cannot be conducted over UDP. Considering Windows DNS servers are usually also Domain Controllers, definitely get this patched as soon as you can,” Trend Micro Zero Day Initiative’s Dustin Childs advised.
Chris Hass, Director of Information Security and Research, Automox, pointed out that a wormable vulnerability like this is an attacker’s dream.
“Not only will the attacker have full control of the system, but they will also be able to leverage the server as a distribution point, allowing the attacker to spread malware between systems without any user interaction. This wormable capability adds a whole other layer of severity and impact, allowing malware authors to write ransomware similar to notable wormable malware such as Wannacry and NotPetya,” he told Help Net Security.
“To make matters worse, Microsoft has deemed the exploitation of this vulnerability as ‘more likely’, and considering the nature of the workaround steps Microsoft has provided if a patch cannot be applied right away, we predict that we will see this vulnerability exploited in the wild soon. The only good news is that this is not a vulnerability in the DNS protocol but limited to Microsoft’s DNS server implementation of it; however, this implementation is widespread, especially in larger organizations.”
Microsoft said that while this vulnerability is not currently known to be used in active attacks, it is essential that customers apply Windows updates to address it vulnerability as soon as possible.
Other fixed flaws of note in this batch of fixes include:
- CVE-2020-1147, a RCE bug in .NET Framework, SharePoint Server, and Visual Studio
- CVE-2020-1349, a Microsoft Outlook RCE vulnerability that could be triggered by opening or viewing the e-mail in the Preview Pane
- CVE-2020-1421, yet another LNK RCE,
- CVE-2020-1374, a RDP RCE flaw affecting only the client side
- Six critical RCE vulnerabilities affecting Hyper-V RemoteFX vGPU, which have been fixed by removing the vulnerable graphics drivers and urging users to use Discrete Device Assignment (DDA) instead.
Jimmy Graham, Sr. Director of Product Management, Qualys, says that the Office, Outlook, Remote Desktop Client, DirectWrite, Address Book, LNK, GDI+, Font Library, and VBScript vulnerabilities should be prioritized for workstation-type devices (i.e., any system that is used for email or to access the internet via a browser).
Microsoft has also released servicing stack updates for each supported operating system, and guidance for enabling a request smuggling filter on IIS (web) servers.
“Failure to strictly adhere to the RFC could allow an unauthenticated attacker to tamper with requests and responses on an IIS website if they sent a specially crafted request to an affected IIS site serviced by a front-end load balancer or proxy. If you’re using a front-end load balancer or proxy, you should review the advisory to ensure malformed requests are not being passed to back-end servers,” Childs advised.
Adobe’s updates
Adobe has released security updates for Adobe ColdFusion (for all platforms), Adobe Genuine Service (for Windows and macOS), Adobe Download Manager, Adobe Media Encoder and Adobe Creative Cloud Desktop Application (for Windows), and fixed 13 CVE-numbered flaws. None of the fixed vulnerabilities are actively exploited in attacks.
Adobe considers the ColdFusion (web-application development computing platform) and Creative Cloud Desktop Application updates more important than the others, because these software offerings have historically been at elevated risk of attack. The former fixes two DLL search-order hijacking flaws that could lead to privilege escalation, while the latter plugs three privilege escalation bugs and a critical flaw that could be exploited to achieve arbitrary file system write.
The Download Manager update carries a fix for a single command injection flaw that could lead to arbitrary code execution, the Genuine Service update nixes three privilege escalation flaws, and Media Encoder users get patches for one vulnerability that could lead to information disclosure and two to code execution.
Oracle’s updates
Oracle’s Critical Patch Update (CPU) is also scheduled for today. The final version of the document detailing the fixed flaw is yet to be released, but according to the pre-release announcement, fixes for 433 flaws will be pushed out.
Todd Schell, senior product manager, security, Ivanti, summarized it thusly: “Oracle Java SE is going to resolve 11 vulnerabilities all of which are remotely exploitable without authentication. Highest CVSS v3.1 base score is 8.3. Fusion Middleware is resolving 53 CVEs, 49 of which may be remotely exploited without authentication. Highest CVSS v3.1 base score is 9.8. MySQL is resolving 40 vulnerabilities, six of which may be remotely exploited without authentication. Highest CVSS v3.1 base score is 9.8.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2020/07/14/july-2020-patch-tuesday/