Microsoft June 2020 Patch Tuesday fix 129 flaws, 11 rated as critical
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-0796 | Unauthenticated RCE in Microsoft SMBv3 (SMBGhost) CVE-2020-0796 ('SMBGhost') is a memory-corruption (CWE-119) flaw in Microsoft's Server Message Block 3.1.1 (SMBv3) implementation, in which certain crafted requests — notably malformed compressed SMBv3 messages — can corrupt memory on the target. An unauthenticated remote attacker can trigger it by sending specially crafted SMBv3 packets directly to any SMB-enabled host, with no credentials or user interaction required. Successful exploitation yields arbitrary code execution on the target server or client, giving the attacker full control of the host, and the flaw was widely characterized as wormable because a compromised host can then attack others. Any Windows system running SMBv3 is affected — SMBv3 is enabled by default on modern Windows 10 and Windows Server builds, with Windows 10 versions 1903/1909 and Windows Server 2019/versions 1903/1909 identified in Microsoft's advisory. Exploitation is confirmed in the wild: the CVE is in CISA KEV (added 2022-02-10) with known ransomware use, EPSS assigns a 99.8% probability of exploitation within 30 days (100th percentile), and no public PoC is listed in the source data. Do: Apply Microsoft's updates per vendor instructions immediately, prioritizing Windows 10 1903/1909 and Windows Server 2019/1903/1909 hosts and anything with SMB (TCP 445) reachable by untrusted networks. Until patched, disable SMBv3 compression per Microsoft's mitigation guidance (setting DisableCompression=1 under LanmanServer) and restrict inbound TCP 445 to trusted sources. Given confirmed ransomware use, hunt for post-exploitation activity on unpatched hosts. | 10.0 | 100% | KEV ransomware PoC ×2 |
| masstens of millions of Windows hosts with SMBv3 enabled; on the order of 1M+ hosts with SMB (TCP 445) exposed to the internet per public scans | |
| CVE-2020-1300 | A remote code execution vulnerability exists when Microsoft Windows fails to properly handle cabinet files.To exploit the vulnerability, an attacker would have A remote code execution vulnerability exists when Microsoft Windows fails to properly handle cabinet files.To exploit the vulnerability, an attacker would have to convince a user to either open a specially crafted cabinet file or spoof a network printer and trick a user into installing a malicious cabinet file disguised as a printer driver.The update addresses the vulnerability by correcting how Windows handles cabinet files., aka 'Windows Remote Code Execution Vulnerability'. NVD description · AI analysis pending | 8.8 group max | 59% |
| — | ||
| CVE-2020-1213 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1214, CVE-2020-1215, CVE-2020-1216, CVE-2020-1230, CVE-2020-1260. NVD description · AI analysis pending | 7.5 | 7% |
| — | ||
| CVE-2020-1229 | A security feature bypass vulnerability exists in Microsoft Outlook when Office fails to enforce security settings configured on a system, aka 'Microsoft Outloo A security feature bypass vulnerability exists in Microsoft Outlook when Office fails to enforce security settings configured on a system, aka 'Microsoft Outlook Security Feature Bypass Vulnerability'. NVD description · AI analysis pending | 4.3 | 4% |
| — | ||
| CVE-2020-9633 | Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier, and Adobe Flash Player for Microsoft Edg Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier, and Adobe Flash Player for Microsoft Edge and Internet Explorer 32.0.0.330 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution. NVD description · AI analysis pending | 9.8 | 8% |
| — |
Full article493 words · extracted from securityaffairs.com · click to collapse
Microsoft June 2020 Patch Tuesday address 129 vulnerabilities, 11 flaws are rated as Critical while 118 are rated as Important in severity.
Microsoft June 2020 Patch Tuesday address 129 vulnerabilities affecting Microsoft Windows, Internet Explorer (IE), Microsoft Edge (EdgeHTML-based and Chromium-based in IE Mode), ChakraCore, Office and Microsoft Office Services and Web Apps, Windows Defender, Microsoft Dynamics, Visual Studio, Azure DevOps, and Microsoft Apps for Android.
This is the highest number of CVEs ever released by Microsoft in a single month. 11 remote code execution vulnerabilities are rated as Critical while 118 are rated as Important in severity.
None of the vulnerabilities being addressed by Microsoft June 2020 Patch Tuesday is known to be exploited by attackers in the wild, Microsoft also added that none of them was disclosed publicly before this publication.
Microsoft addressed three flaws in Microsoft Server Message Block (SMB), two of these vulnerabilities affect Microsoft Server Message Block 3.1.1 (SMBv3). Microsoft rated the three vulnerabilities as “exploitation more likely” based on Microsoft’s Exploitability Index.
Both denial-of-service vulnerability (CVE-2020-1284) and the information-disclosure vulnerability (CVE-2020-1206) in SMBv3 could be exploited by a remote, authenticated attacker.
The CVE-2020-1206 flaw can be chained with previously disclosed SMBGhost (CVE-2020-0796) vulnerabilities to remotely execute arbitrary code on vulnerable systems.
One of the most notable critical issues is the CVE-2020-1299 flaw, it is related to the way Windows handles Shortcut files (.LNK) and could be exploited by attackers to execute arbitrary code on the targeted systems remotely. An attacker could trigger the flaw by tricking the victim into processing a specially crafted .LNK file, for example by putting it on a USB drive in an attempt to bridge an air-gapped network.
Another interesting issue addressed this month by Microsoft is the Microsoft Outlook Security Feature Bypass Vulnerability tracked as CVE-2020-1229. The vulnerability could be exploited by attackers to automatically load remote images, even when displayed in the Preview Pane.
Microsoft June 2020 Patch Tuesday also addressed a Windows Remote Code Execution Vulnerability tracked as CVE-2020-1300.
“A remote code execution vulnerability exists when Microsoft Windows fails to properly handle cabinet files.” reads the advisory published by Microsoft.
“To exploit the vulnerability, an attacker would have to convince a user to either open a specially crafted cabinet file or spoof a network printer and trick a user into installing a malicious cabinet file disguised as a printer driver.”
Microsoft also fixed other three critical flaws in the VBScript engine and tracked as CVE-2020-1213, CVE-2020-1216, and CVE-2020-1260. The vulnerabilities exist in the way it handles objects in memory, allowing an attacker to execute arbitrary code in the context of the current user.
Microsoft also fixed a new critical remote code execution flaw, tracked as CVE-2020-9633, which affects Adobe Flash Player for Windows systems.
The list of flaws addressed this month by Microsoft is available here:
https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/2020-Jun
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Microsoft June 2020 Patch Tuesday, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/104536/security/microsoft-june-2020-patch-tuesday.html