Microsoft released a security update under Patch Tuesday and fixed nearly 50 security vulnerabilities that affected various Microsoft product and the patch is available for 900 million Windows users.
Microsoft issued a patch for various software products including the following:
- Microsoft Windows
- Internet Explorer
- Microsoft Office and Microsoft Office Services and Web Apps
- ASP.NET Core
- .NET Core
- .NET Framework
- OneDrive for Android
- Microsoft Dynamics
Among 49 vulnerabilities, 7 of them marked as “critical” severity, 41 categorized as “Important” and one vulnerability fixed as “Moderate severity”
Most of the critical vulnerabilities (CVE-2020-0606), (CVE-2020-0605) affected the .Net Framework and it allows an attacker to execute arbitrary code remotely in the context of the current user.
If the user logged in as admin, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
Another remote code execution infection vulnerability (CVE-2020-0646) exists when the Microsoft .NET Framework fails to validate input properly and it leads to an attacker who successfully exploited this vulnerability could take control of an affected system.
Microsoft fixed a remote code execution vulnerabilities(CVE-2020-0611), (CVE-2020-0609) that existing in Windows RDP Client when a user connects to a malicious server. n attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client.
Crypto Vulnerability Reported by NSA
Microsoft also fixed a critical cryptographic vulnerability that affects Windows 10, Clients & Servers Discovered By NSA.
The vulnerability can be tracked as CVE-2020-0601 and the successful exploitation of the vulnerability allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software.
Windows users are recommended to immediately patch the critical Cryptographic vulnerability that existing in the Windows CryptoAPI (Crypt32.dll).
NSA Consider this vulnerability is severe and the sophisticated cyber criminals easily exploit this vulnerability as well as it has widespread if the system will not be patched.
Microsoft Security Updates
.NET Framework
1 | .NET Framework | CVE-2020-0606 | .NET Framework Remote Code Execution Vulnerability |
2 | .NET Framework | CVE-2020-0605 | .NET Framework Remote Code Execution Vulnerability |
3 | .NET Framework | CVE-2020-0646 | .NET Framework Remote Code Execution Injection Vulnerability |
Windows RDP
1 | Windows RDP | CVE-2020-0609 | Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability |
2 | Windows RDP | CVE-2020-0637 | Remote Desktop Web Access Information Disclosure Vulnerability |
3 | Windows RDP | CVE-2020-0612 | Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability |
4 | Windows RDP | CVE-2020-0611 | Remote Desktop Client Remote Code Execution Vulnerability |
5 | Windows RDP | CVE-2020-0610 | Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability |
Microsoft Windows
1 | Microsoft Windows | CVE-2020-0644 | Windows Elevation of Privilege Vulnerability |
2 | Microsoft Windows | CVE-2020-0624 | Win32k Elevation of Privilege Vulnerability |
3 | Microsoft Windows | CVE-2020-0635 | Windows Elevation of Privilege Vulnerability |
4 | Microsoft Windows | CVE-2020-0620 | Microsoft Cryptographic Services Elevation of Privilege Vulnerability |
5 | Microsoft Windows | CVE-2020-0616 | Microsoft Windows Denial of Service Vulnerability |
6 | Microsoft Windows | CVE-2020-0608 | Win32k Information Disclosure Vulnerability |
7 | Microsoft Windows | CVE-2020-0601 | Windows CryptoAPI Spoofing Vulnerability |
8 | Microsoft Windows | CVE-2020-0621 | Windows Security Feature Bypass Vulnerability |
Microsoft Windows Search Component
1 | Microsoft Windows Search Component | CVE-2020-0633 | Windows Search Indexer Elevation of Privilege Vulnerability |
2 | Microsoft Windows Search Component | CVE-2020-0623 | Windows Search Indexer Elevation of Privilege Vulnerability |
3 | Microsoft Windows Search Component | CVE-2020-0613 | Windows Search Indexer Elevation of Privilege Vulnerability |
4 | Microsoft Windows Search Component | CVE-2020-0614 | Windows Search Indexer Elevation of Privilege Vulnerability |
5 | Microsoft Windows Search Component | CVE-2020-0632 | Windows Search Indexer Elevation of Privilege Vulnerability |
6 | Microsoft Windows Search Component | CVE-2020-0627 | Windows Search Indexer Elevation of Privilege Vulnerability |
7 | Microsoft Windows Search Component | CVE-2020-0628 | Windows Search Indexer Elevation of Privilege Vulnerability |
8 | Microsoft Windows Search Component | CVE-2020-0625 | Windows Search Indexer Elevation of Privilege Vulnerability |
9 | Microsoft Windows Search Component | CVE-2020-0626 | Windows Search Indexer Elevation of Privilege Vulnerability |
10 | Microsoft Windows Search Component | CVE-2020-0629 | Windows Search Indexer Elevation of Privilege Vulnerability |
11 | Microsoft Windows Search Component | CVE-2020-0631 | Windows Search Indexer Elevation of Privilege Vulnerability |
12 | Microsoft Windows Search Component | CVE-2020-0630 | Windows Search Indexer Elevation of Privilege Vulnerability |
Microsoft Office
1 | Microsoft Office | CVE-2020-0650 | Microsoft Excel Remote Code Execution Vulnerability |
2 | Microsoft Office | CVE-2020-0652 | Microsoft Office Memory Corruption Vulnerability |
3 | Microsoft Office | CVE-2020-0653 | Microsoft Excel Remote Code Execution Vulnerability |
4 | Microsoft Office | CVE-2020-0651 | Microsoft Excel Remote Code Execution Vulnerability |
5 | Microsoft Office | CVE-2020-0647 | Microsoft Office Online Spoofing Vulnerability |
Other software products
1 | Apps | CVE-2020-0654 | Microsoft OneDrive for Android Security Feature Bypass Vulnerability |
2 | ASP.NET | CVE-2020-0603 | ASP.NET Core Remote Code Execution Vulnerability |
3 | ASP.NET | CVE-2020-0602 | ASP.NET Core Denial of Service Vulnerability |
4 | Common Log File System Driver | CVE-2020-0615 | Windows Common Log File System Driver Information Disclosure Vulnerability |
5 | Common Log File System Driver | CVE-2020-0634 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
6 | Common Log File System Driver | CVE-2020-0639 | Windows Common Log File System Driver Information Disclosure Vulnerability |
7 | Microsoft Dynamics | CVE-2020-0656 | Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability |
8 | Windows Hyper-V | CVE-2020-0617 | Hyper-V Denial of Service Vulnerability |
9 | Windows Media | CVE-2020-0641 | Microsoft Windows Elevation of Privilege Vulnerability |
10 | Windows Subsystem for Linux | CVE-2020-0636 | Windows Subsystem for Linux Elevation of Privilege Vulnerability |
11 | Windows Update Stack | CVE-2020-0638 | Update Notification Manager Elevation of Privilege |
Microsoft strongly recommended installing these security updates for all the windows users to avoid the security risk and protect your Windows.
You can refer the complete patch details for the full list of vulnerabilities resolved, advisories, in the Jan 2020 Patch here.
Also Read: What is the Difference Between Authentication vs Authorization?