Microsoft’s
February Patch Tuesday update was much more extensive then has been the norm
with 99 CVEs being revealed with 12 considered critical and one fixing a memory
corruption zero day in Internet Explorer that is being exploited in the wild.
February is also the first month that Microsoft did not issue a general update for Windows 7 and Server 2008 as each reached its end of service coverage in January. However, the company did post updates for those companies that arranged for an Extended Security Update for their software.
Ivanti’s Todd
Schell, senior product manager, security, said the fact that Microsoft included
these updates with their overall rollout could cause some confusion as some
admins and consumers may mistakenly believe they can fix any issues associated
with this now outdated software.
For those
whose only concern is with supported software, Schell noted most admins will
not have to do much, despite the high number of issues
this month, as the updates are pushed automatically. There is one caveat.
“SQL and
Exchange admins do get a bit of extra work this month as both of those products
are included in the updates released,” he said.
The most
prominent issue this month is CVE-2020-0674.
Microsoft issued
an advisory notice for CVE-2020-0674 in January
stating at the time it was aware of limited targeted attacks in a remote code
execution vulnerability in the scripting engine of Internet Explorer across all
versions of Windows that would let a hacker obtain the same rights as a current
user. CVE-2020-0674 is only rated a moderate threat, but Satnam Narang, senior
research engineer at Tenable, told SC Media it is important for organizations
to apply the patch as soon as possible.
Additional
high-priority critical vulnerabilities patched by Microsoft included CVE-2020-0662,
a remote code execution vulnerability exists in the way that Windows handles
objects in memory; CVE-2020-0681, a remote code execution vulnerability in the
Windows Remote Desktop Client that can be exploited when a user connects to a
malicious server; and CVE-2020-0729, a remote code execution vulnerability
exists in Microsoft Windows that could allow remote code execution if a .LNK
file is processed.
Jimmy Graham,
senior director of product management, vulnerability at Qualys, said that while
CVE-2020-0662 is labeled by Microsoft as less likely to be exploited, “this
vulnerability can be attacked over the network with no user interaction. The
impacted service is not stated in the bulletin. Based on the information given,
this should be prioritized across all Windows servers and workstations.”
CVE-2020-0688,
a remote code execution vulnerability in Microsoft Exchange, was picked by Allan
Liska, intelligence analyst at Recorded Future, for special consideration. He
noted that while it is only rated a important – and not critical – vulnerability
he believes it is particularly dangerous because it is likely to be exploited.
“The
vulnerability exists in the way Exchange handles objects in memory. A specially
crafted email would allow an attacker to exploit the Exchange Server and
execute arbitrary code. Microsoft identifies this vulnerability as likely to be
exploited,” Liska said.
Graham
explained that exploitation of the flaw would lead to arbitrary code execution
in the context of the System user, granting an attacker the ability to create a
new account, install programs, and view, change or delete data.
