Vulnerabilitycritical

Microsoft Patch Tuesday — March 2020: Vulnerability disclosures and Snort coverage

Cisco TalosMar 10, 2020 · 17:23 UTC (Mar 10, 2020)4 min read2 · 1 read

Read at blog.talosintelligence.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2020-0796 CVE-2020-0684 CVE-2020-0801 CVE-2020-0807 CVE-2020-0809 CVE-2020-0869 CVE-2020-0823 CVE-2020-0825 CVE-2020-0826 CVE-2020-0827 CVE-2020-0828 CVE-2020-0829 CVE-2020-0831 CVE-2020-0832 CVE-2020-0833 CVE-2020-0848 CVE-2020-0824 CVE-2020-0847 CVE-2020-0881 CVE-2020-0883 CVE-2020-0768 CVE-2020-0811 CVE-2020-0812 CVE-2020-0816 CVE-2020-0830 CVE-2020-0850 CVE-2020-0851 CVE-2020-0852 CVE-2020-0855 CVE-2020-0761 CVE-2020-0645 CVE-2020-0690 CVE-2020-0700 CVE-2020-0758 CVE-2020-0762 CVE-2020-0763 CVE-2020-0769 CVE-2020-0770 CVE-2020-0771 CVE-2020-0772 CVE-2020-0773 CVE-2020-0774 CVE-2020-0775 CVE-2020-0776 CVE-2020-0777 CVE-2020-0778 CVE-2020-0779 CVE-2020-0780 CVE-2020-0781 CVE-2020-0783 CVE-2020-0785 CVE-2020-0786 CVE-2020-0787 CVE-2020-0788 CVE-2020-0789 CVE-2020-0791 CVE-2020-0793 CVE-2020-0795 CVE-2020-0797 CVE-2020-0798 CVE-2020-0799 CVE-2020-0800 CVE-2020-0802 CVE-2020-0803 CVE-2020-0804 CVE-2020-0806 CVE-2020-0808 CVE-2020-0810 CVE-2020-0813 CVE-2020-0814 CVE-2020-0815 CVE-2020-0819 CVE-2020-0820 CVE-2020-0822 CVE-2020-0834 CVE-2020-0835 CVE-2020-0840 CVE-2020-0841 CVE-2020-0842 CVE-2020-0843 CVE-2020-0844 CVE-2020-0845 CVE-2020-0853 CVE-2020-0854 CVE-2020-0857 CVE-2020-0858 CVE-2020-0859 CVE-2020-0860 CVE-2020-0861 CVE-2020-0863 CVE-2020-0864 CVE-2020-0865 CVE-2020-0866 CVE-2020-0867 CVE-2020-0868 CVE-2020-0871 CVE-2020-0872 CVE-2020-0874 CVE-2020-0876 CVE-2020-0877 CVE-2020-0879 CVE-2020-0880 CVE-2020-0882 CVE-2020-0884 CVE-2020-0885 CVE-2020-0887 CVE-2020-0891 CVE-2020-0892 CVE-2020-0893 CVE-2020-0894 CVE-2020-0896 CVE-2020-0897 CVE-2020-0898 CVE-2020-0902 CVE-2020-0903 CVE-2020-0849 CVE-2020-0765

Tags: cve-2020-0796 cve-2020-0684 cve-2020-0801 cve-2020-0807 cve-2020-0809 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2020-0690 +75 related CVEs CVE-2020-0883 CVE-2020-0881 CVE-2020-0684 CVE-2020-0807 CVE-2020-0809 CVE-2020-0801 CVE-2020-0869 CVE-2020-0887 CVE-2020-0814 CVE-2020-0791 CVE-2020-0798 CVE-2020-0861+63 more	An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'	9.8 group max	7%		Mar 12, 2020
CVE-2020-0758 +2 related CVEs CVE-2020-0815 CVE-2020-0700	An elevation of privilege vulnerability exists when Azure DevOps Server and Team Foundation Services improperly handle pipeline job tokens, aka 'Azure DevOps…	7.5 group max	2%		Mar 12, 2020
CVE-2020-0761	A remote code execution vulnerability exists when Active Directory integrated DNS (ADIDNS) mishandles objects in memory	8.8	4%		Sep 11, 2020
CVE-2020-0765	An information disclosure vulnerability exists in the Remote Desktop Connection Manager (RDCMan) application when it improperly parses XML input containing a…	5.5	5%		Mar 12, 2020
CVE-2020-0848 +6 related CVEs CVE-2020-0831 CVE-2020-0829 CVE-2020-0768 CVE-2020-0812 CVE-2020-0811 CVE-2020-0813	A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption…	7.5	10%		Mar 12, 2020
CVE-2020-0787	Privilege Escalation in Microsoft Windows Background Intelligent Transfer Service (BITS)	7.8	43%	KEVRansomwarePoC	Mar 12, 2020 KEV Jan 28, 2022
CVE-2020-0789	A denial of service vulnerability exists when the Visual Studio Extension Installer Service improperly handles hard links, aka 'Visual Studio Extension…	7.1	<1%		Mar 12, 2020
CVE-2020-0795 +3 related CVEs CVE-2020-0891 CVE-2020-0893 CVE-2020-0894	This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated…	5.4	2%		Mar 12, 2020
CVE-2020-0796	Unauthenticated RCE in Microsoft SMBv3 (SMBGhost)	10.0	100%	KEVRansomwarePoC ×2	Mar 12, 2020 KEV Feb 10, 2022
CVE-2020-0810	An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows file creation in…	7.8	1%		Mar 12, 2020
CVE-2020-0816 +5 related CVEs CVE-2020-0825 CVE-2020-0827 CVE-2020-0823 CVE-2020-0826 CVE-2020-0828	A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'	8.8 group max	11%		Mar 12, 2020
CVE-2020-0830 +4 related CVEs CVE-2020-0832 CVE-2020-0833 CVE-2020-0847 CVE-2020-0824	A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory…	7.5	9%		Mar 12, 2020
CVE-2020-0835	An elevation of privilege vulnerability exists when Windows Defender antimalware platform improperly handles hard links, aka 'Windows Defender Antimalware…	7.8	<1%		Apr 15, 2020
CVE-2020-0850 +4 related CVEs CVE-2020-0852 CVE-2020-0851 CVE-2020-0855 CVE-2020-0892	A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code…	8.8 group max	9%		Mar 12, 2020
CVE-2020-0872	A remote code execution vulnerability exists in Application Inspector version v1.0.23 or earlier when the tool reflects example code snippets from third-party…	9.6	10%		Mar 12, 2020
CVE-2020-0884	A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL, aka 'Microsoft Visual Studio Spoofing…	3.7	2%		Mar 12, 2020
CVE-2020-0902	An elevation of privilege vulnerability exists in Service Fabric File Store Service under certain conditions, aka 'Service Fabric Elevation of Privilege'	9.8	3%		Mar 12, 2020
CVE-2020-0903	A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected…	5.4	2%		Mar 12, 2020

From the original article

4 min read at blog.talosintelligence.com

Update (March 12, 2020): Microsoft released an out-of-band patch for CVE-2020-0796, a code execution vulnerability SMB client and server for Windows. An unauthenticated attacker could exploit this vulnerability to execute remote code. Snort rules 53425 - 53428 protect against exploitation of CVE-2020-0796.

Cisco Talos

blog.talosintelligence.com

Read the full article at Cisco Talos

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.