Vulnerabilitycritical
Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage
- CVEs
- CVE-2020-0601CVE-2020-0603CVE-2020-0605CVE-2020-0606CVE-2020-0646CVE-2020-0609CVE-2020-0610CVE-2020-0611CVE-2020-0640CVE-2020-0616CVE-2020-0654CVE-2020-0602CVE-2020-0607CVE-2020-0608CVE-2020-0612CVE-2020-0613CVE-2020-0614CVE-2020-0615CVE-2020-0617CVE-2020-0620CVE-2020-0621CVE-2020-0622CVE-2020-0623CVE-2020-0624CVE-2020-0625CVE-2020-0626CVE-2020-0627CVE-2020-0628CVE-2020-0629CVE-2020-0630CVE-2020-0631CVE-2020-0632CVE-2020-0633CVE-2020-0634CVE-2020-0635CVE-2020-0636CVE-2020-0637CVE-2020-0638CVE-2020-0639CVE-2020-0641CVE-2020-0642CVE-2020-0643CVE-2020-0644CVE-2020-0647CVE-2020-0650CVE-2020-0651CVE-2020-0652CVE-2020-0653CVE-2020-0656
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-0601 | ECC Certificate Spoofing in Microsoft Windows CryptoAPI (Crypt32.dll) | 8.1 | 89% | KEV | KEV |
CVE-2020-0603+1 related CVE | A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully… | 8.8 group max | 21% | ||
CVE-2020-0646+2 related CVEs | XML Injection RCE in Microsoft .NET Framework | 9.8 group max | 99% | KEVPoC | KEV |
| CVE-2020-0624 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of… | 7.8 group max | 2% | ||
CVE-2020-0609+1 related CVE | A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system… | 9.8 | 75% | ||
| CVE-2020-0612 | A denial of service vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an attacker connects to the target system using RDP and sends… | 7.5 | 5% | ||
| CVE-2020-0637 | An information disclosure vulnerability exists when Remote Desktop Web Access improperly handles credential information, aka 'Remote Desktop Web Access… | 6.5 | 5% | ||
| CVE-2020-0638 | Local Privilege Escalation in Microsoft Update Notification Manager (Windows 10/Server) | 7.8 | 2% | KEVRansomware | KEV |
| CVE-2020-0640 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption… | 7.5 | 9% | ||
| CVE-2020-0647 | A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Spoofing… | 5.4 | <1% | ||
CVE-2020-0653+3 related CVEs | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel… | 7.8 | 21% | ||
| CVE-2020-0654 | A security feature bypass vulnerability exists in Microsoft OneDrive App for Android.This could allow an attacker to bypass the passcode or fingerprint… | 9.1 | 3% | ||
| CVE-2020-0656 | A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected… | 5.4 | 1% |
From the original article
4 min read at blog.talosintelligence.com
Updated January 15th: Added an Advanced Custom Detection (ACD) signature for AMP that can be used to detect exploitation of CVE-2020-0601 by spoofing certificates masquerading as a Microsoft ECC Code Signing Certificate Authority. Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.