Microsoft Released a Security Update for 900 Million Windows Users & Patched 49 Vulnerabilities – Update Now

Microsoft released a security update under Patch Tuesday and fixed nearly 50 security vulnerabilities that affected various Microsoft product and the patch is available for 900 million Windows users.

Microsoft issued a patch for various software products including the following:

• Microsoft Windows
• Internet Explorer
• Microsoft Office and Microsoft Office Services and Web Apps
• ASP.NET Core
• .NET Core
• .NET Framework
• OneDrive for Android
• Microsoft Dynamics

Among 49 vulnerabilities, 7 of them marked as “critical” severity, 41 categorized as “Important” and one vulnerability fixed as “Moderate severity”

Most of the critical vulnerabilities (CVE-2020-0606), (CVE-2020-0605) affected the .Net Framework and it allows an attacker to execute arbitrary code remotely in the context of the current user.

If the user logged in as admin, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Another remote code execution infection vulnerability (CVE-2020-0646) exists when the Microsoft .NET Framework fails to validate input properly and it leads to an attacker who successfully exploited this vulnerability could take control of an affected system. 

Microsoft fixed a remote code execution vulnerabilities(CVE-2020-0611), (CVE-2020-0609) that existing in Windows RDP  Client when a user connects to a malicious server. n attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client. 

Crypto Vulnerability Reported by NSA

Microsoft also fixed a critical cryptographic vulnerability that affects Windows 10, Clients & Servers Discovered By NSA.

The vulnerability can be tracked as CVE-2020-0601 and the successful exploitation of the vulnerability allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software.

Windows users are recommended to immediately patch the critical Cryptographic vulnerability that existing in the Windows CryptoAPI (Crypt32.dll).

NSA Consider this vulnerability is severe and the sophisticated cyber criminals easily exploit this vulnerability as well as it has widespread if the system will not be patched.

Microsoft Security Updates

.NET Framework

1	.NET Framework	CVE-2020-0606	.NET Framework Remote Code Execution Vulnerability
2	.NET Framework	CVE-2020-0605	.NET Framework Remote Code Execution Vulnerability
3	.NET Framework	CVE-2020-0646	.NET Framework Remote Code Execution Injection Vulnerability

Windows RDP

1	Windows RDP	CVE-2020-0609	Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability
2	Windows RDP	CVE-2020-0637	Remote Desktop Web Access Information Disclosure Vulnerability
3	Windows RDP	CVE-2020-0612	Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability
4	Windows RDP	CVE-2020-0611	Remote Desktop Client Remote Code Execution Vulnerability
5	Windows RDP	CVE-2020-0610	Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability

Microsoft Windows

1	Microsoft Windows	CVE-2020-0644	Windows Elevation of Privilege Vulnerability
2	Microsoft Windows	CVE-2020-0624	Win32k Elevation of Privilege Vulnerability
3	Microsoft Windows	CVE-2020-0635	Windows Elevation of Privilege Vulnerability
4	Microsoft Windows	CVE-2020-0620	Microsoft Cryptographic Services Elevation of Privilege Vulnerability
5	Microsoft Windows	CVE-2020-0616	Microsoft Windows Denial of Service Vulnerability
6	Microsoft Windows	CVE-2020-0608	Win32k Information Disclosure Vulnerability
7	Microsoft Windows	CVE-2020-0601	Windows CryptoAPI Spoofing Vulnerability
8	Microsoft Windows	CVE-2020-0621	Windows Security Feature Bypass Vulnerability

Microsoft Windows Search Component

1	Microsoft Windows Search Component	CVE-2020-0633	Windows Search Indexer Elevation of Privilege Vulnerability
2	Microsoft Windows Search Component	CVE-2020-0623	Windows Search Indexer Elevation of Privilege Vulnerability
3	Microsoft Windows Search Component	CVE-2020-0613	Windows Search Indexer Elevation of Privilege Vulnerability
4	Microsoft Windows Search Component	CVE-2020-0614	Windows Search Indexer Elevation of Privilege Vulnerability
5	Microsoft Windows Search Component	CVE-2020-0632	Windows Search Indexer Elevation of Privilege Vulnerability
6	Microsoft Windows Search Component	CVE-2020-0627	Windows Search Indexer Elevation of Privilege Vulnerability
7	Microsoft Windows Search Component	CVE-2020-0628	Windows Search Indexer Elevation of Privilege Vulnerability
8	Microsoft Windows Search Component	CVE-2020-0625	Windows Search Indexer Elevation of Privilege Vulnerability
9	Microsoft Windows Search Component	CVE-2020-0626	Windows Search Indexer Elevation of Privilege Vulnerability
10	Microsoft Windows Search Component	CVE-2020-0629	Windows Search Indexer Elevation of Privilege Vulnerability
11	Microsoft Windows Search Component	CVE-2020-0631	Windows Search Indexer Elevation of Privilege Vulnerability
12	Microsoft Windows Search Component	CVE-2020-0630	Windows Search Indexer Elevation of Privilege Vulnerability

Microsoft Office

1	Microsoft Office	CVE-2020-0650	Microsoft Excel Remote Code Execution Vulnerability
2	Microsoft Office	CVE-2020-0652	Microsoft Office Memory Corruption Vulnerability
3	Microsoft Office	CVE-2020-0653	Microsoft Excel Remote Code Execution Vulnerability
4	Microsoft Office	CVE-2020-0651	Microsoft Excel Remote Code Execution Vulnerability
5	Microsoft Office	CVE-2020-0647	Microsoft Office Online Spoofing Vulnerability

Other software products

1	Apps	CVE-2020-0654	Microsoft OneDrive for Android Security Feature Bypass Vulnerability
2	ASP.NET	CVE-2020-0603	ASP.NET Core Remote Code Execution Vulnerability
3	ASP.NET	CVE-2020-0602	ASP.NET Core Denial of Service Vulnerability
4	Common Log File System Driver	CVE-2020-0615	Windows Common Log File System Driver Information Disclosure Vulnerability
5	Common Log File System Driver	CVE-2020-0634	Windows Common Log File System Driver Elevation of Privilege Vulnerability
6	Common Log File System Driver	CVE-2020-0639	Windows Common Log File System Driver Information Disclosure Vulnerability
7	Microsoft Dynamics	CVE-2020-0656	Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability
8	Windows Hyper-V	CVE-2020-0617	Hyper-V Denial of Service Vulnerability
9	Windows Media	CVE-2020-0641	Microsoft Windows Elevation of Privilege Vulnerability
10	Windows Subsystem for Linux	CVE-2020-0636	Windows Subsystem for Linux Elevation of Privilege Vulnerability
11	Windows Update Stack	CVE-2020-0638	Update Notification Manager Elevation of Privilege

Microsoft strongly recommended installing these security updates for all the windows users to avoid the security risk and protect your Windows.

You can refer the complete patch details for the full list of vulnerabilities resolved, advisories, in the Jan 2020 Patch here.

Also Read: What is the Difference Between Authentication vs Authorization?