Security News > 2020 > October > October Patch Tuesday: Microsoft Patches Critical, Wormable RCE Bug
Microsoft has pushed out fixes for 87 security vulnerabilities in October - 11 of them critical - and one of those is potentially wormable.
"Coming in at 53 of the 87 vulnerabilities, patching the OS knocks out 60 percent of the vulnerabilities listed, along with over half of the critical RCE vulnerabilities resolved today."
Microsoft gives this bug its highest exploitability rating, meaning attacks in the wild are extremely likely - and as such, it carries a severity rating of 9.8 out of 10 on the CvSS vulnerability scale.
A critical Windows Hyper-V RCE bug meanwhile allows an attacker to run a specially crafted program on an affected guest OS to execute arbitrary code on the host OS. And, other critical problems impact the Windows Camera Codec, both resulting from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer.
"Security teams are still reeling from efforts around reducing exposure to CVE-2020-1472, and today's Patch Tuesday thankfully brings a slightly lightened load of vulnerabilities compared to the previous seven months, with no vulnerabilities currently known to be exploited in the wild," Jonathan Cran, head of research at Kenna Security, told Threatpost.
News URL
https://threatpost.com/october-patch-tuesday-wormable-bug/160044/
Related news
- Microsoft July 2024 Patch Tuesday fixes 142 flaws, 4 zero-days (source)
- Critical Windows licensing bugs, plus two others under attack, top Patch Tuesday (source)
- Microsoft August 2024 Patch Tuesday fixes 9 zero-days, 6 exploited (source)
- July 2024 Patch Tuesday forecast: The end of an AV giant in the US (source)
- Week in review: RADIUS protocol critical vuln, Microsoft 0-day exploited for a year, AT&T breach (source)
- CISA warns critical Geoserver GeoTools RCE flaw is exploited in attacks (source)
- Critical Apache HugeGraph Vulnerability Under Attack - Patch ASAP (source)
- Windows Patch Tuesday update might send a user to the BitLocker recovery screen (source)
- Progress warns of critical RCE bug in Telerik Report Server (source)
- Critical ServiceNow RCE flaws actively exploited to steal credentials (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-08-17 | CVE-2020-1472 | Use of Insufficiently Random Values vulnerability in multiple products An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). | 5.5 |