August 2020 Patch Tuesday: Microsoft fixes two vulnerabilities under attack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-1337 | An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system. NVD description · AI analysis pending | 7.8 | 14% | PoC ×2 |
| — | |
| CVE-2020-1380 | Memory Corruption RCE in Microsoft Internet Explorer Scripting Engine CVE-2020-1380 is a memory corruption vulnerability (an out-of-bounds write, CWE-787) in the Microsoft Internet Explorer scripting engine that can corrupt memory when the engine processes maliciously crafted script content. It is triggered by luring a user to visit an attacker-controlled or compromised web page in Internet Explorer or in an application that invokes the IE engine, with no authentication required. Successful exploitation allows the attacker to execute arbitrary code in the context of the current user, gaining that user's privileges on the system. All installations of the affected Microsoft Internet Explorer versions are potentially exposed, with the greatest risk to legacy and enterprise Windows systems that still browse or render content with IE. The flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating exploitation in the wild, while no public proof-of-concept is known and ransomware use is unconfirmed. Do: Apply Microsoft's June 2020 (or later) Windows cumulative security updates on every system running Internet Explorer, per the vendor instructions cited by CISA. Given the KEV listing (added 2021-11-03) and high EPSS (~24% 30-day exploitation probability, 98th percentile), treat this as a priority patch. Reduce attack surface by steering users to Microsoft Edge instead of IE for web browsing and auditing internal apps or legacy sites that still invoke the IE engine to render external content. | 7.8 | 24% | KEV |
| masshundreds of millions of Windows devices historically able to run Internet Explorer; exact currently-vulnerable count unknown | |
| CVE-2020-1464 | File Signature Validation Spoofing in Microsoft Windows CVE-2020-1464 is a spoofing vulnerability in Microsoft Windows caused by improper validation of file digital signatures (CWE-347). It is triggered when Windows accepts a file whose signature is malformed or improperly formed, treating it as validly signed. An attacker who can introduce such a file onto a system can bypass security features that depend on signature verification, allowing improperly signed files to load as if trusted — a common technique for malware delivery and defense evasion. Essentially all Microsoft Windows deployments on affected versions are exposed until patched. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), confirming exploitation in the wild, though no public proof-of-concept is known and any ransomware linkage is unconfirmed. Do: Apply Microsoft's security updates for CVE-2020-1464 on all Windows systems per vendor instructions, prioritizing internet-facing and high-value endpoints, and verify patch coverage fleet-wide given the CISA KEV listing. Until patched, avoid relying solely on digital-signature-based trust decisions (e.g., application allowlisting or signature-gated file loading) for files of unknown origin. | 7.8 | 39% | KEV PoC |
| mass≈1 billion+ Windows devices worldwide (essentially all unpatched Windows installations) | |
| CVE-2020-1472 | Unauthenticated Privilege Escalation (Zerologon) in Microsoft Netlogon Domain Controllers CVE-2020-1472, widely known as "Zerologon," is an elevation-of-privilege flaw in how the Netlogon secure channel is established over the Netlogon Remote Protocol (MS-NRPC) on Microsoft domain controllers. An unauthenticated attacker with network reachability to a domain controller sends specially crafted Netlogon messages to establish a vulnerable secure channel and then runs a specially crafted application on the network to obtain domain administrator access. Successful exploitation yields domain administrator privileges, effectively full compromise of the Active Directory environment, and the flaw is known to be used in ransomware operations. Any organization running affected Windows Server versions (2008 through 20H2) as domain controllers is exposed, along with environments using Netlogon implementations from Samba and distributions or products from Fedora, openSUSE, Canonical (Ubuntu), Debian, Synology, and Oracle. Exploitation is highly active: a public Zerologon PoC/exploit is available, the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, with known ransomware use), and EPSS estimates a 99.4% probability of exploitation within 30 days. Do: Apply the vendor updates on all domain controllers and other affected systems immediately, following Microsoft's two-phase Netlogon secure channel guidance (the enforcement phase of the phased rollout began in Q1 2021). Audit Netlogon secure-channel connections and event logs for clients still using vulnerable connections before enabling full enforcement, and install updated packages for Samba and other Netlogon implementations from Fedora, openSUSE, Ubuntu, Debian, Synology, and Oracle. Given known ransomware use, prioritize patching any domain controller reachable from user networks, VPNs, or the internet. | 5.5 | 99% | KEV ransomware PoC |
| massmillions of domain controllers worldwide (essentially every Active Directory domain), with hundreds of thousands of domain controllers/RPC endpoints… | |
| CVE-2020-9697 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a disclosure of se Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a disclosure of sensitive data vulnerability. Successful exploitation could lead to memory leak. NVD description · AI analysis pending | 5.5 | 3% |
| — |
Full article938 words · extracted from helpnetsecurity.com · click to collapse
On this August 2020 Patch Tuesday:
- Microsoft has plugged 120 flaws, two of which are being exploited in attacks in the wild
- Adobe has delivered security updates for Adobe Acrobat, Reader and Lightroom
- Apple has released updates for iCloud on Windows
- Google has updated Chrome with security fixes
Microsoft’s updates
Microsoft has released patched for 120 CVEs, 17 of which are critical and the rest important. One (CVE-2020-1464) is publicly known and being actively exploited, and another one (CVE-2020-1380) is also under attack.
CVE-2020-1464 allows an attacker to bypass security features intended to prevent improperly signed files from being loaded, and affects all supported versions of Windows, so patching it should definitely be a priority.
“CVE-2020-1464 is proof that security organizations should not be making their patching decisions solely off the CVSS score and severity rating and instead should be approaching all the security vulnerabilities as a gap in their attack surface, welcoming any malicious player into their network,” noted Richard Melick, Senior Technical Product Manager, Automox.
“Coming in only at a CVSS of 5.3, this spoofing vulnerability has been reported exploited in both legacy and newer versions of Windows and Windows Server, which is more worrisome as 25% of connected Windows devices are still running Windows 7.”
CVE-2020-1380 is a bug in Internet Explorer’s scripting engine and allow code execution on a system running a vulnerable version of the browser.
“In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked ‘safe for initialization’ in an application or Microsoft Office document that hosts the IE rendering engine,” Microsoft explained.
“The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.”
This flaw is also under active attack, so IE users should be protected against it as soon as possible
Trend Micro Zero Day Initiative’s Dustin Childs also singled out CVE-2020-1472, a NetLogon Elevation of Privilege Vulnerability, as very important to patch quickly.
“A vulnerability in the Netlogon Remote Protocol (MS-NRPC) could allow attackers to run their applications on a device on the network. An unauthenticated attacker would use MS-NRPC to connect to a Domain Controller (DC) to obtain administrative access,” he explained, but noted that fixing it entirely will be a problem.
“[The patch released today] enables the DCs to protect devices, but a second patch currently slated for Q1 2021 enforces secure Remote Procedure Call (RPC) with Netlogon to fully address this bug. After applying this patch, you’ll still need to make changes to your DC. Microsoft published guidelines to help administrators choose the correct settings.”
“There are many non-Windows device implementations of the Netlogon Remote Protocol (also called MS-NRPC). To ensure that vendors of non-compliant implementations can provide customers with updates, a second release that is planned for Q1 2021 will enforce protection for all domain-joined devices,” Microsoft has added.
Other critical vulnerabilities have been fixed in the .NET Framework, Media Foundation, Microsoft Edge, the Windows Codecs Library, the MSHTML Engine, the Scripting Engine, Windows Media, and Outlook.
The provided Outlook updates should also be quickly implemented, as they fix two vulnerabilities – a RCE and information disclosure bug – that could be triggered from the Preview Pane.
As announced last week, Microsoft has also delivered today a fix for CVE-2020-1337, a privilege escalation vulnerability in the Windows Print Spooler service, which affects all the Windows releases from Windows 7 to Windows 10 (32 and 64-bit). The researchers who unearthed it have promised to publish a PoC exploit this week.
Adobe’s updates
Adobe has released security updates for various versions of Adobe Acrobat and Reader for Windows and macOS, and Adobe Lightroom for Windows.
The former are more important, as they fix 11 critical vulnerability that could lead to code execution and allow attackers to bypass of a security feature, and 15 additional high-risk bugs.
Acrobat and Reader are also more widely used than Adobe Lightroom, which is a family of image organization and image manipulation software. The update for Lightroom fixes one privilege escalation flaw.
None of the fixed vulnerabilities are being actively exploited and there are no public exploits available, but the Zero Day Initiative announced it will tweet the proof-of-concept demonstration for CVE-2020-9697, a memory leak bug in Acrobat and Reader, tomorrow.
If you’re still using Adobe Flash, consider the fact that it reaches end-of-life at the end of the year and plan accordingly.
Apple’s updates
As predicted, Apple chose this Patch Tuesday to release security updates for iCloud for Windows 7.20 (for Windows 7 and later) and 11.3 (for Windows 10 and later).
The two updates deliver fixes for (mostly) the same vulnerabilities:
- A dozen of flaws in the Image I/O programming interface framework, all of which may allow attackers to achieve arbitrary code execution if the user opes a maliciously crafted image or PDF file
- A variety of flaws affecting the WebKit browser engine, the WebKit Web Inspector debugging tool and the WebKit Page Loading implementation. Some may be exploited to execute code, some to bypass Pointer Authentication or prevent Content Security Policy from being enforced, some to conceal the destination of a URL, and some to inject code.
Google’s updates
Google has not yet promoted Chrome 85 from the beta channel, but has released Chrome 84.0.4147.125 for Windows, Mac, and Linux.
No critical vulnerabilities have been fixed, but plenty of high- and medium-risk ones have.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2020/08/11/august-2020-patch-tuesday/