Microsoft’s Mega Patch Tuesday is Largest Ever
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-0199 | Remote Code Execution in Microsoft Office and WordPad via crafted document files CVE-2017-0199 is a remote code execution vulnerability in Microsoft Office and WordPad that stems from improper parsing of specially crafted files. Attackers trigger it by getting a user to open a malicious document, after which attacker-controlled code executes with the privileges of the logged-in user. Anyone running the affected Microsoft Office or WordPad software is exposed, and CISA notes the flaw has been leveraged in ransomware campaigns; no CVSS score is available in the source data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and EPSS assigns a 99.9% probability of exploitation within 30 days (100th percentile), indicating active, ongoing exploitation. Do: Apply Microsoft's security updates for Office and Windows per vendor instructions, as required by CISA's KEV catalog; the flaw was publicly reported as fixed in Microsoft's April 2017 security updates. Until patched, treat unsolicited Office documents and email attachments as high-risk, since exploitation requires a user to open a crafted file. Verify that all Office and WordPad installations across the estate—especially endpoints that handle untrusted documents—have received the update. | 7.8 | 100% | KEV ransomware PoC ×6 |
| masshundreds of millions of Office installations worldwide (exact count unknown) | |
| CVE-2020-1181 | A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Micr A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'. NVD description · AI analysis pending | 8.8 | 69% |
| — | ||
| CVE-2020-1281 | A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerabil A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'. NVD description · AI analysis pending | 8.8 | 14% |
| — |
Full article327 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft released fixes for 129 vulnerabilities in its regular monthly update round yesterday, the fourth month in a row to hit over 100 CVEs and the largest of any Patch Tuesday.
Of the 129 CVEs, only 11 are rated critical and there are no flaws being actively exploited in the wild.
Some 98 vulnerabilities can be resolved by deploying OS and browser updates, while the other 31 are spread across Office, SharePoint, Defender, Endpoint Protection and developer tools like Visual Studio, ChakraCore and Azure Dev Ops, according to Ivanti senior product manager, Todd Schell.
He argued that the COVID-related shift to mass home working is causing problems for companies reliant on VPNs to patch.
“There are many solutions that can manage updates without the need for a VPN. Another difficulty companies are facing is user connectivity,” he added.
“I had a conversation with one company that is managing updates without needing to use a VPN to access the network. Their challenge is their users have low internet speeds. Monthly updates requiring hundreds of megabytes of patches, or gigabytes in some cases, become problematic as well.”
Allan Liska, intelligence analyst at Recorded Future, said admins should start with CVE-2020-1281, a remote code execution vulnerability in Microsoft’s Object Linking & Embedding (OLE). It affects Windows 7-10 and Windows Server 2008-2019.
“The vulnerability exists in the way OLE validates user input. An attacker who sent a specially crafted file or program, or convinced a victim to download one, could execute malicious code on the victim’s machine,” he explained. “Microsoft assigned this vulnerability a CVSS score of 7.8; a similar vulnerability, CVE-2017-0199, has been widely exploited including by the Lazarus group and APT 34.”
Others pointed to a remote code execution bug in SharePoint as demanding urgent attention.
CVE-2020-1181 affects the way SharePoint processes unsafe ASP .Net web controls. Although it requires a user to be authenticated to exploit the flaw, SharePoint itself is an increasingly popular target for attackers.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/microsofts-mega-patch-tuesday-is/