Security News
One flaw exists in Microsoft's Visual Studio Code is a free source-code editor made by Microsoft for Windows, Linux and macOS. The other is in the Microsoft Windows Codecs Library; the codecs module provides stream and file interfaces for transcoding data in Windows programs. According to Microsoft, one "Important" severity flaw stems from the way that Microsoft Windows Codecs Library handles objects in memory.
Microsoft has released two out-of-band security updates designed to address remote code execution bugs found to affect the Microsoft Windows Codecs Library and Visual Studio Code. Microsoft patched two similar RCE bugs in June, leading to user confusion because of the ways the security updates were being delivered - via the Microsoft Store instead of the normal Windows Update channel.
These 4 packages had collected over 1,000 total downloads over the course of the last few months up until being removed by NPM yesterday. Although the malicious packages were spotted and removed by NPM, I was able to dig into Sonatype's automated malware detection system archives to obtain copies of their source code, as it had existed on NPM downloads.
Over the years, Microsoft has extended DLP to more of Office, covering Exchange, SharePoint, Teams, OneDrive for Business and Office apps like Word, PowerPoint, Excel and Outlook, as well as third-party applications that incorporate the MIP SDK. Now it's integrated into Windows 10 and the new Edge browser, without needing an additional agent. You use the new Microsoft 365 compliance center to start managing devices - although you can onboard devices using Group Policy, Microsoft Endpoint Configuration Manager, MDM or a local script.
Microsoft on Tuesday issued fixes for 87 newly discovered security vulnerabilities as part of its October 2020 Patch Tuesday, including two critical remote code execution flaws in Windows TCP/IP stack and Microsoft Outlook. Another critical RCE vulnerability in Windows Hyper-V exists due to improper validation of input from an authenticated user on a guest operating system.
Microsoft is continuing its push to move all Windows 10 configuration options into their modern Settings feature. This year, Microsoft has been making a push to migrate all of the Windows 10 settings into the Settings app.
The United States Cyber Command warns that users should apply the latest patches for Microsoft software to ensure they won't fall victim to exploitation attempts. The most important of these issues, US Cyber Command points out, is CVE-2020-16898, a critical bug in the Windows TCP/IP stack that can be triggered remotely to potentially achieve remote code execution on the victim machine.
Microsoft is performing a test where they are installing a suite of Office progressive web apps in Windows 10 without asking permission from the user. Over the past week, Microsoft has been conducting a test where they have been forcibly installing Word, Excel, PowerPoint, and Outlooks PWAs into Microsoft Edge and registering them with Windows 10.
One of the vulnerabilities that Microsoft addressed as part of the October 2020 Patch Tuesday is a critical bug in Windows' TCP/IP driver that could lead to the remote execution of code. An attacker could send specially crafted ICMPv6 Router Advertisement packets to a remote Windows machine to exploit the flaw and execute arbitrary code, Microsoft explains.
Microsoft's October 2020 Patch Tuesday fixed 87 security bugs, one of which is an "Important" Windows Spoofing Vulnerability that abuses CAT files. The flaw allows an attacker to combine a legitimately signed Microsoft Windows Installer package with the attacker's JAR file into an encapsulating JAR file.