Microsoft’s January 2020 Patch Tuesday Kicks Off the New Year with 49 New CVEs
UPDATE 01-30-2020: The Solution section has been updated to reflect that a direct check plugin to test for CVE-2020-0609, CVE-2020-0610 and CVE-2020-0612 has been released (Plugin ID 133306).
UPDATE 01-23-2020: Researcher ollypwn has released a proof of concept (PoC) titled BlueGate which leverages CVE-2020-0609 and CVE-2020-0610 for a potential Denial of Service (DoS) attack.
Microsoft kicks off 2020 by patching 49 CVEs, eight of which are rated as critical.
Microsoft rang in 2020 with 49 CVEs addressed in the January 2020 Patch Tuesday release. This update contains 12 remote code execution flaws and eight vulnerabilities that are rated as critical. This month’s updates include patches for Microsoft Windows, Microsoft Office, Internet Explorer, .NET Framework, NET Core, ASP.NET Core and Microsoft Dynamics. The following is a breakdown of the most important CVEs from this month’s release.
CVE-2020-0601 | Windows CryptoAPI spoofing vulnerability
CVE-2020-0601 is a spoofing vulnerability in crypt32.dll, a core cryptographic module in Microsoft Windows responsible for implementing certificate and cryptographic messaging functions in Microsoft’s CryptoAPI. For a more detailed examination of this vulnerability, check out our blog post here.
CVE-2020-0609 and CVE-2020-0610 | Windows Remote Desktop Gateway (RD Gateway) remote code execution vulnerability
In the wake of critical pre-authentication flaws from 2019, including BlueKeep (CVE-2019-0708) and DejaBlue (CVE-2019-1181, CVE-2019-1182, CVE-2019-1222 CVE-2019-1226), Microsoft has patched two new remote desktop flaws, this time in the Windows Remote Desktop Gateway (RD Gateway). CVE-2019-0609 and CVE-2019-0610 are both pre-authentication remote code execution vulnerabilities, which can be exploited when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. Microsoft notes these flaws have not yet been exploited in the wild, but rates these both as ‘Exploitation More Likely.’ Patches have been released for Server 2012, Server 2012 R2, Server 2016 and Server 2019.
CVE-2020-0611 | Remote Desktop Client remote code execution vulnerability
CVE-2020-0611 is a remote code execution vulnerability that exists in the Windows Remote Desktop Client. Exploitation of this flaw would allow an attacker to execute arbitrary code on the machine of the connected client. To successfully exploit this flaw, an attacker would have to convince a user to connect to a malicious server, making exploitation of this flaw less likely. While this flaw is only scored as a CVSS 7.5, Microsoft still rates this as critical severity.
CVE-2020-0605, CVE-2020-0606 and CVE-2020-0646 | .NET Framework remote code execution vulnerability
CVE-2020-0605, CVE-2020-0606, and CVE-2020-0646 are remote code execution vulnerabilities in .NET Framework. Exploitation of these vulnerabilities requires that a user open a specially crafted file with an affected version of .NET Framework. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file.
CVE-2020-0603 | ASP.NET Core remote code execution vulnerability
CVE-2020-0603 is a remote code execution vulnerability in ASP.NET. Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of ASP.NET Core. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file.
CVE-2020-0650, CVE-2020-0651 and CVE-2019-0653 | Microsoft Excel remote code execution vulnerability
This month, Microsoft released 3 CVEs for remote code execution vulnerabilities in Microsoft Excel: CVE-2020-0650, CVE-2020-0651 and CVE-2020-0653. These flaws exist due to a flaw in properly handling objects in memory. Successful exploitation of these vulnerabilities would allow an attacker to execute arbitrary code in the context of the current user. To exploit these flaws, an attacker would need to convince a logged-in user to open a specially crafted file with an affected version of Microsoft Excel.
Windows 7 and Server 2008 R2 end of support
As a reminder, Windows 7 and Server 2008 support was discontinued on January 14, 2020, so we strongly recommend identifying and upgrading end-of-life systems. Plugin ID 122615 (Microsoft Windows 7 / Server 2008 R2 Unsupported Version Detection) can be used to identify the OS running on a target to assist in identifying end-of-support devices.
Tenable solutions
Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name Contains January 2020.
With that filter set, click the plugin families to the left, and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:
A list of all the plugins released for Tenable’s January 2020 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched. An uncredentialized check testing for systems vulnerable to CVE-2020-0609/CVE-2020-0610/CVE-2020-0612 (Plugin ID 133306) have been released.
الحصول على مزيد من المعلومات
- Microsoft's January 2020 Security Updates
- Tenable plugins for Microsoft January 2020 Patch Tuesday Security Updates
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.
مقالات ذات صلة
CVE-2024-5806: Progress MOVEit Transfer Authentication Bypass Vulnerability
June 25, 2024Progress Software has patched a high severity authentication bypass in the MOVEit managed file transfer (MFT) solution. As MOVEit has been a popular target for ransomware gangs and other threat actors, we strongly recommend prioritizing patching of this vulnerability.
CVE-2024-28995: SolarWinds Serv-U Path/Directory Traversal Vulnerability Exploited in the Wild
June 21, 2024Following the publication of proof-of-concept exploit details for a high-severity flaw in SolarWinds Serv-U, researchers have observed both automated and manual in-the-wild exploitation attempts; patching is strongly advised.
Cybersecurity Snapshot: FTC Believes TikTok Broke U.S. Law, Asks Justice Dept. To Intervene, while French Cyber Agency Warns About Nobelium / Midnight Blizzard
June 21, 2024TikTok’s legal troubles in the U.S. could get thornier after the FTC refers complaint to the DOJ. Meanwhile, France says Russia-backed Nobelium / Midnight Blizzard is a major cyber espionage threat to European governments. Plus, check out a Tenable poll about dealing with vulnerabilities without patches. And did LockBit 3.0 make a comeback in May? Maybe – or maybe not. And much more!
How the regreSSHion Vulnerability Could Impact Your Cloud Environment
July 5, 2024With growing concern over the recently disclosed regreSSHion vulnerability, we’re explaining here what it is, why it’s so significant, what it could mean for your cloud environment and how Tenable Cloud Security can help.
Cybersecurity Snapshot: Malicious Versions of Cobalt Strike Taken Down, While Microsoft Notifies More Orgs About Midnight Blizzard Email Breach
July 5, 2024Check out the results of a multinational operation against illegal instances of Cobalt Strike. Plus, more organizations are learning that Midnight Blizzard accessed their email exchanges with Microsoft. Meanwhile, Carnegie Mellon has a new report about how to fix and mitigate API vulnerabilities. And two new reports shed light on cyber insurance trends. And much more!
Cybersecurity Snapshot: Memory Bugs Pervasive in Open Source SW, While Car Dealership Chaos Persists After Ransomware Attack
June 28, 2024Check out why memory vulnerabilities are widespread in open source projects. Plus, get the latest on the ransomware attack that’s disrupted car sales in North America. In addition, find out why a majority of organizations grew their cyber budgets this year. And learn how confidential data from U.S. chemical facilities may have been accessed by hackers. And much more!
- Vulnerability Management