Patch Tuesday: Dangerous Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-15999 | Heap Buffer Overflow in FreeType Font Rendering in Google Chrome (CVE-2020-15999) Google Chrome bundles the open-source FreeType library for font rendering, and that library contains a heap buffer overflow (CWE-787, out-of-bounds write) in its Load_SBit_Png function. The flaw is triggered when the browser loads a crafted font containing a malicious PNG image embedded as embedded bitmap data, typically from a web page the victim visits, corrupting heap memory with attacker-controlled data. Successful exploitation can crash the browser or execute code in the renderer, and it was used in the wild as part of an exploit chain combined with CVE-2020-17087 (Windows kernel) and CVE-2020-16010 (Android) to escape the sandbox. Anyone running an affected Google Chrome release that ships the vulnerable FreeType code, across Windows, macOS, Linux, Chrome OS and Android, is affected, meaning effectively the entire Chrome install base at the time of disclosure. The vulnerability is confirmed exploited in the wild (listed in CISA's KEV catalog, added 2021-11-03; ransomware use unknown), Google patched it in Chrome 86.0.4240.111, no public proof-of-concept is known, and EPSS estimates a 44.3% probability of exploitation within 30 days (99th percentile). Do: Update Google Chrome to 86.0.4240.111 or later (any current stable-channel release satisfies this), and where other software bundles FreeType directly, update to FreeType 2.10.4 or later per the upstream fix. Because the bug was chained with CVE-2020-17087 on Windows and CVE-2020-16010 on Android, also apply the corresponding Microsoft Windows and Android updates to close the sandbox-escape chain. Use endpoint management to inventory browser versions and confirm no endpoints remain below the fixed release, as required by the CISA KEV catalog. | 9.6 | 44% | KEV PoC ×2 |
| masson the order of billions of users (Chrome's active user base exceeded ~3 billion at the time; the vulnerable FreeType code shipped in every affected release) | |
| CVE-2020-17016 | Microsoft SharePoint Server Spoofing Vulnerability Microsoft SharePoint Server Spoofing Vulnerability NVD description · AI analysis pending | 8.0 group max | 3% |
| — | ||
| CVE-2020-17061 | Microsoft SharePoint Remote Code Execution Vulnerability Microsoft SharePoint Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.8 | 4% |
| — | ||
| CVE-2020-17087 | Windows Kernel Buffer Overflow Enables Local Privilege Escalation (CVE-2020-17087) CVE-2020-17087 is a local elevation-of-privilege flaw in the Windows kernel caused by an incorrect buffer size calculation (CWE-131), producing a kernel buffer overflow; public analyses from Microsoft and Google's disclosure place the vulnerable code in the kernel's cryptographic driver (cng.sys). A local attacker with low privileges can trigger the overflow without user interaction, gaining code execution in kernel context and effectively full control of the host (high impact on confidentiality, integrity, and availability; CVSS 7.8). Every Windows system on the affected builds is exposed: Windows 10 versions 1507 through 20H2, Windows 7, 8.1, RT 8.1, and Windows Server 2008, which at disclosure meant essentially the entire supported Windows install base. The flaw was exploited as a zero-day in the wild: Google disclosed its use in targeted attacks, reportedly chained with a Chrome zero-day, and CISA added it to the KEV catalog on 2021-11-03; EPSS currently estimates a 5.4% probability of exploitation within 30 days (92nd percentile), with ransomware association listed as unknown. Do: Apply Microsoft's November 2020 Patch Tuesday security updates to all affected Windows 10, Windows 7, 8.1, RT 8.1, and Windows Server 2008 systems; this is CISA's required action for the KEV listing and no official workaround is known. Prioritize hosts where untrusted users can log on locally or via RDP, and ensure Chromium-based browsers are fully updated since this kernel bug was reportedly chained with a Chrome zero-day. After patching, verify the November 2020 update is installed; treat any ransomware association as currently unconfirmed. | 7.8 | 5% | KEV |
| mass≈1 billion+ devices (essentially the entire supported Windows install base at disclosure) |
Full article341 words · extracted from infosecurity-magazine.com · click to collapse
After a brief respite last month, Microsoft hit system administrators with another large patch load this month, issuing fixes for 112 CVEs including one being actively exploited in the wild.
The updates for November cover a wide range of products including Windows, Office and Office 365, IE, Edge, Edge Chromium, Exchange Server, Microsoft Dynamics, Azure Sphere, Windows Defender, Microsoft Teams, Azure SDK, DevOps, ChakraCore and Visual Studio.
However, experts are urging customers to prioritize CVE-2020-17087, an Elevation of Privilege bug in the Windows Kernel Cryptography Driver. It affects all versions of the OS, from the Extended Security Update (ESU) in Windows 7 and Server 2008 up to the latest Windows 10 20H2 versions.
“While the vulnerability is only rated as Important by Microsoft, it is a zero-day vulnerability and has been publicly disclosed. This means attackers have already been detected using it in the wild and information on how to exploit it has been distributed publicly, allowing additional threat actors easy access to reproduce this exploit,” explained Ivanti senior product manager, Todd Schell.
“CVE-2020-17087 was discovered by Google researchers as being exploited in tandem with a Google Chrome flaw (CVE-2020-15999), for which an update was made available on October 20. The two vulnerabilities should be resolved as soon as possible.”
Meanwhile, Qualys vulnerability signatures product manager, Animesh Jain, warned of six flaws in SharePoint that should be fairly high up on the to-do list.
“Three of these vulnerabilities (CVE-2020-17016, CVE-2020-17015, CVE-2020-17060) involve spoofing vulnerabilities, and two (CVE-2020-16979, CVE-2020-17017) involve information disclosure vulnerabilities,” she explained. “The remaining one (CVE-2020-17061) is a remote code execution vulnerability; because of this, it is highly recommended to prioritize these patches across all SharePoint deployments.”
Many sysadmins will notice that Microsoft has pared back the information it includes with each vulnerability. Although this was ostensibly done to fall in line with industry standard CVSS, some have argued that this makes it harder for non-security specialists to understand how relevant a bug/CVE is to their organization.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/zeroday-hides-another-100-cve/