Security News > 2020 > October > October Patch Tuesday: Microsoft Patches Critical, Wormable RCE Bug
Microsoft has pushed out fixes for 87 security vulnerabilities in October - 11 of them critical - and one of those is potentially wormable.
"Coming in at 53 of the 87 vulnerabilities, patching the OS knocks out 60 percent of the vulnerabilities listed, along with over half of the critical RCE vulnerabilities resolved today."
Microsoft gives this bug its highest exploitability rating, meaning attacks in the wild are extremely likely - and as such, it carries a severity rating of 9.8 out of 10 on the CvSS vulnerability scale.
A critical Windows Hyper-V RCE bug meanwhile allows an attacker to run a specially crafted program on an affected guest OS to execute arbitrary code on the host OS. And, other critical problems impact the Windows Camera Codec, both resulting from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer.
"Security teams are still reeling from efforts around reducing exposure to CVE-2020-1472, and today's Patch Tuesday thankfully brings a slightly lightened load of vulnerabilities compared to the previous seven months, with no vulnerabilities currently known to be exploited in the wild," Jonathan Cran, head of research at Kenna Security, told Threatpost.
News URL
https://threatpost.com/october-patch-tuesday-wormable-bug/160044/
Related news
- Week in review: Critical Zimbra RCE vulnerability exploited, Patch Tuesday forecast (source)
- Microsoft October 2024 Patch Tuesday fixes 5 zero-days, 118 flaws (source)
- Microsoft cleans up hot mess of Patch Tuesday preview (source)
- VMware fixes bad patch for critical vCenter Server RCE flaw (source)
- Microsoft SharePoint RCE flaw exploits in the wild – you've had 3 months to patch (source)
- Synology Urges Patch for Critical Zero-Click RCE Flaw Affecting Millions of NAS Devices (source)
- Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 91 flaws (source)
- Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 89 flaws (source)
- Microsoft slips Task Manager and processor count fixes into Patch Tuesday (source)
- Patch Tuesday: Four Critical Vulnerabilities Paved Over (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-08-17 | CVE-2020-1472 | Use of Insufficiently Random Values vulnerability in multiple products An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). | 5.5 |