Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage

CVE-2020-0601 (known as 'Curveball') is a spoofing flaw in Crypt32.dll, the Windows CryptoAPI component that validates Elliptic Curve Cryptography (ECC) certificates, which mishandles ECC certificate parameters when checking signatures. An attacker can trigger it by signing malicious content, most notably an executable, with a spoofed, attacker-controlled ECC certificate that Windows accepts as if it were issued by a trusted certificate authority; the attack vector is network-based but requires user interaction (CVSS 3.1: 8.1, AV:N/AC:L/PR:N/UI:R). Successful exploitation makes attacker-supplied malware appear to come from a legitimate, trusted software vendor, defeating code-signing trust prompts and signature-based trust decisions, with high impact on confidentiality and integrity. Affected systems are the Microsoft Windows 10 builds 1507 through 1909 and Windows Server versions 1803, 1903, 1909, 2016 and 2019 in the CISA data, with Go also listed as an affected vendor via its ECC certificate validation, effectively covering the mainstream Windows install base at the time. The flaw was discovered by the NSA and patched in the January 2020 Patch Tuesday; it is now CISA KEV-listed (added 2021-11-03, ransomware use unknown) with very high predicted exploitation risk (EPSS 89.4%, 100th percentile), and no public PoC is tracked in this data.

Do: Apply Microsoft's January 2020 Patch Tuesday cumulative security updates for all affected Windows 10 and Windows Server builds, per CISA's required action (apply updates per vendor instructions). Prioritize user workstations and servers that validate signed binaries, Authenticode signatures, or TLS certificates, since exploitation hinges on a user or application trusting a spoofed ECC-signed artifact. If Go is deployed in your environment, update Go toolchains to a patched January 2020 or later release, as Go was also acknowledged as an affected vendor.

A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.

Microsoft .NET Framework fails to properly validate input in certain conditions, allowing XML/XOML injection (CWE-91) that leads to remote code execution. Per the CVSS vector, the flaw is exploitable over the network with no authentication and no user interaction, and the public proof-of-concept demonstrates it by injecting crafted XOML into SharePoint workflow definitions. A successful attacker can run arbitrary code in the context of the vulnerable application, with high impact on confidentiality, integrity, and availability. Any organization running affected .NET Framework versions is potentially exposed, with the demonstrated attack path targeting servers running SharePoint or other .NET-based applications that process untrusted input. The vulnerability is being actively exploited: it was added to the CISA KEV on November 3, 2021, and EPSS assigns a 99.2% probability of exploitation within 30 days (top percentile).

Do: Apply Microsoft's January 2020 (or later) .NET Framework security updates on all Windows systems, prioritizing internet-facing servers — especially SharePoint — in line with the CISA KEV required action. As interim mitigation, restrict and monitor untrusted input reaching .NET/SharePoint workflow (XOML) processing on exposed servers. Inventory hosts for outdated .NET Framework versions and verify the January 2020 cumulative updates are installed.

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0642.

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0610.

A denial of service vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability'.

An information disclosure vulnerability exists when Remote Desktop Web Access improperly handles credential information, aka 'Remote Desktop Web Access Information Disclosure Vulnerability'.

CVE-2020-0638 is a local elevation of privilege flaw in the way Microsoft's Update Notification Manager handles files (CWE-59, a link-following/race-condition class of bug), affecting Windows 10 versions 1709, 1803, 1809, 1903 and 1909, plus Windows Server 1803, 1903, 1909 and 2019. To trigger it, an attacker must first gain code execution on the victim system with limited privileges; no user interaction is required after that initial foothold. Successful exploitation allows the attacker to elevate privileges with high impact on confidentiality, integrity and availability, making it a useful step in ransomware and other intrusion chains to take full control of a host. Microsoft fixed the issue in its January 2020 Patch Tuesday security updates. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-05-23 with known ransomware use, confirming exploitation in the wild; no public proof-of-concept is known.

Do: Apply Microsoft's January 2020 security updates (or any later cumulative update) to all affected Windows 10 and Windows Server systems, prioritizing user workstations and servers where an attacker with an existing foothold would matter; federal agencies must patch per CISA KEV/BOD 22-01 timelines. Inventory endpoints still running Windows 10 builds 1709–1909 and Windows Server 1803/1903/1909/2019 and verify the installed cumulative update level. Because exploitation requires prior code execution, pair patching with EDR and least-privilege controls to disrupt ransomware chains.

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'.

A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Spoofing Vulnerability'.

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0651, CVE-2020-0653.

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0650, CVE-2020-0651.

A security feature bypass vulnerability exists in Microsoft OneDrive App for Android.This could allow an attacker to bypass the passcode or fingerprint requirements of the App.The security update addresses the vulnerability by correcting the way Microsoft OneDrive App for Android handles sharing links., aka 'Microsoft OneDrive for Android Security Feature Bypass Vulnerability'.

A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability'.