Security News > 2020 > October > October Patch Tuesday: Microsoft Patches Critical, Wormable RCE Bug

Microsoft has pushed out fixes for 87 security vulnerabilities in October - 11 of them critical - and one of those is potentially wormable.

"Coming in at 53 of the 87 vulnerabilities, patching the OS knocks out 60 percent of the vulnerabilities listed, along with over half of the critical RCE vulnerabilities resolved today."

Microsoft gives this bug its highest exploitability rating, meaning attacks in the wild are extremely likely - and as such, it carries a severity rating of 9.8 out of 10 on the CvSS vulnerability scale.

A critical Windows Hyper-V RCE bug meanwhile allows an attacker to run a specially crafted program on an affected guest OS to execute arbitrary code on the host OS. And, other critical problems impact the Windows Camera Codec, both resulting from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer.

"Security teams are still reeling from efforts around reducing exposure to CVE-2020-1472, and today's Patch Tuesday thankfully brings a slightly lightened load of vulnerabilities compared to the previous seven months, with no vulnerabilities currently known to be exploited in the wild," Jonathan Cran, head of research at Kenna Security, told Threatpost.

News URL

https://threatpost.com/october-patch-tuesday-wormable-bug/160044/