A few hours after Adobe today released security updates for five of its widely-distributed software, Microsoft also issued its February 2020 Patch Tuesday edition with patches for a total of 99 new vulnerabilities.
According to the advisories, 12 of the total issues patched by the tech giant this month are critical in severity, and the remaining 87 have been listed as important.
Five of the bugs are listed as publicly known at the time of release, four of which are important in severity and one critical (CVE-2020-0674) that is also listed as under active attack.
Microsoft warned about this zero-day vulnerability in Internet Explorer (IE) browser last month when it released an advisory without releasing a patch for millions of its affected users.
As explained previously, this flaw could allow a remote attacker to execute arbitrary code on targeted computers and take full control over them just by convincing victims into opening a maliciously crafted web page on the vulnerable Microsoft browser.
All supported versions of Microsoft Windows also contain a critical RCE flaw (CVE-2020-0662) that an attacker with a domain user account can exploit to execute arbitrary code on the targeted system with elevated permissions.
Remote Desktop Client also contains two critical issues, tracked as CVE-2020-0681 and CVE-2020-0734, which are not wormable bugs but could be used to compromise vulnerable systems when connected to a malicious or untrusted server.
“To exploit this vulnerability, an attacker would need to have control of a server and then convince a user to connect to it. An attacker would have no way of forcing a user to connect to the malicious server, they would need to trick the user into connecting via social engineering, DNS poisoning or using a Man in the Middle (MITM) technique,” the advisory says.
“An attacker could also compromise a legitimate server, host malicious code on it, and wait for the user to connect.”
There’s another critical vulnerability (CVE-2020-0729) that exists in the way Microsoft Windows operating system parses LNK shortcuts, successful exploitation of which could allow a remote attacker to execute arbitrary code on the affected system and take full control of it.
“The attacker could present to the user a removable drive, or remote share, that contains a malicious .LNK file and an associated malicious binary. When the user opens this drive(or remote share) in Windows Explorer, or any other application that parses the .LNK file, the malicious binary will execute code of the attacker’s choice on the target system,” the advisory says.
Besides this, most of the other critical issues are memory corruption flaws in IE, Edge browser, and Chakra scripting engine, which, if successfully exploited, could also allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system in the context of the current user.
To be noted, there’s an important security feature bypass issue (CVE-2020-0689) that poses a significant threat to security-conscious users. According to Microsoft, there’s a vulnerability in the secure boot feature that could let an attacker bypass it and load untrusted software on the system.
The latest updates also contain patches for multiple privilege escalation vulnerabilities affecting versions of the Windows operating system, which could let low privileged attackers run arbitrary code in kernel mode.
Users and system administrators are highly recommended to apply the latest security patches as soon as possible to keep cybercriminals and hackers away from taking control of their computers.
For installing the latest security updates, you can head on to Settings → Update & Security → Windows Update → Check for updates on your computer, or you can install the updates manually.
Credit: The Hacker News By: noreply@blogger.com (Unknown)
