Microsoft June Patch Tuesday Fixes 129 Flaws in Largest-Ever Update

Microsoft June Patch Tuesday Fixes 129 Flaws in Largest-Ever Update

The June Patch Tuesday replace included CVEs for 11 serious remote code-execution vulnerabilities and regarding SMB bugs.

Microsoft has released patches for 129 vulnerabilities as portion of its June Patch Tuesday updates – the absolute most sensible selection of CVEs ever released by Microsoft in a single month.

For the length of the blockbuster safety replace, 11 serious remote code-execution flaws had been patched in Dwelling windows, SharePoint server, Dwelling windows Shell, VBScript and other merchandise. Unlike other most stylish monthly updates from Microsoft, its June updates didn’t consist of any zero-day vulnerabilities being actively attacked within the wild.

“For June, Microsoft released patches for 129 CVEs covering Microsoft Dwelling windows, Net Explorer (IE), Microsoft Edge (EdgeHTML-based completely and Chromium-based completely in IE Mode), ChakraCore, Office and Microsoft Office Products and companies and Net Apps, Dwelling windows Defender, Microsoft Dynamics, Visual Studio, Azure DevOps, and Microsoft Apps for Android,” based completely on Dustin Childs, with Trend Micro’s Zero Day Initiative, in a Tuesday post. “This brings the total selection of Microsoft patches released this 365 days to 616 – loyal 49 alarmed of the total selection of CVEs they addressed in all of 2017.”

Microsoft’s June Patch Tuesday volume beats out the replace from Could perhaps additionally, the place it released fixes for 111 safety flaws, including 16 serious bugs and 96 which may perhaps perhaps perhaps well be rated important.

SMBv3 Flaws

Satnam Narang, workers overview engineer at Tenable, urged Threatpost that a trio of fixes caught out within the Patch Tuesday updates, for flaws in Microsoft Server Message Block (SMB). Two of these flaws exist in Microsoft Server Message Block 3.1.1 (SMBv3). All three vulnerabilities are famous because they’re rated as “exploitation more seemingly” based completely on Microsoft’s Exploitability Index.

The 2 flaws in SMBv3 consist of a denial-of-provider vulnerability (CVE-2020-1284) and an files-disclosure vulnerability (CVE-2020-1206), every of which will seemingly be exploited by a remote, authenticated attacker.

Narang acknowledged the issues “practice within the footsteps” of CVE-2020-0796, a “wormable” remote code execution flaw in SMBv3 that used to be patched assist in March, dubbed “SMBGhost.” CISA lately warned that the free up of a fully functional proof-of-thought (PoC) for SMBGhost may perhaps perhaps perhaps soon spark a wave of cyberattacks.

The third vulnerability patched in Microsoft SMB, CVE-2020-1301, is a remote code-execution vulnerability that exists within the sort SMBv1 handles requests. To affirm the flaw, an attacker would ought to peaceable be authenticated and to send a specially crafted packet to a focused SMBv1 server.

Narang acknowledged this flaw “may perhaps perhaps perhaps perform a sense of déjà vu” for one other remote code-execution vulnerability in SMBv1, EternalBlue, which used to be historical within the WannaCry 2017 ransomware attacks.

“On the opposite hand, the adaptation between these two is that EternalBlue will seemingly be exploited by an unauthenticated attacker, whereas this flaw requires authentication, based completely on Microsoft,” he acknowledged. “This vulnerability impacts Dwelling windows 7 and Dwelling windows 2008, every of which reached their slay of enhance in January 2020. On the opposite hand, Microsoft has provided patches for every working systems.”

VBScript

Diverse serious remote code-execution flaws had been chanced on in VBScript, Microsoft’s Full of life Scripting language that is modeled on Visual Traditional (CVE-2020-1214, CVE-2020-1215, CVE-2020-1216, CVE-2020-1230, CVE-2020-1260). The flaws exist within the sort that the VBScript engine handles objects in memory; an attacker may perhaps perhaps perhaps tainted memory in such a method that enables them to rating arbitrary code within the context of the hot user.

In a exact-lifestyles assault space, an attacker may perhaps perhaps perhaps host a specially crafted web page that is designed to affirm the vulnerability via Net Explorer after which convince a user to note the earn web page online.

“An attacker who efficiently exploited the vulnerability may perhaps perhaps perhaps perform the identical user rights because the hot user,” acknowledged Microsoft. “If the hot user is logged on with administrative-user rights, an attacker who efficiently exploited the vulnerability may perhaps perhaps perhaps clutch clutch watch over of an affected machine. An attacker may perhaps perhaps perhaps then install programs; watch, alternate or delete files; or perform original accounts with corpulent user rights.”

Assorted Serious Flaws

Moreover of imprint is a serious flaw (CVE-2020-1299) that exists in Microsoft Dwelling windows, which may perhaps perhaps perhaps enable remote code-execution if a .LNK file is processed. An .LNK file is a shortcut or “link.” An attacker can embed a malicious .LNK in a removable drive or remote fraction, after which convince the victim to originate the drive or fraction in Dwelling windows Explorer. Then, the malicious binary will rating the code. An attacker who efficiently exploited this vulnerability may perhaps perhaps perhaps perform the identical user rights because the local user, based completely on Microsoft.

The replace also addressed a Dwelling windows serious RCE flaw (CVE-2020-1300) that exists when Microsoft Dwelling windows fails to properly take care of cabinet recordsdata. To affirm the vulnerability, an attacker would ought to convince a user to both originate a specially crafted cabinet file or spoof a network printer and trick a user into inserting in a malicious cabinet file disguised as a printer driver, based completely on Microsoft’s replace.

One more serious vulnerability (CVE-2020-1286) exists attributable to Dwelling windows Shell no longer properly validating file paths. An attacker may perhaps perhaps perhaps exploit the flaw by convincing a user to originate a specially crafted file, after which may perhaps perhaps perhaps be in a spot to bustle arbitrary code within the context of the user, based completely on Microsoft’s replace.

“If the hot user is logged on as an administrator, an attacker may perhaps perhaps perhaps clutch clutch watch over of the affected machine,” acknowledged Microsoft. “An attacker may perhaps perhaps perhaps then install programs; watch, alternate or delete files; or perform original accounts with elevated privileges. Users whose accounts are configured to personal fewer privileges on the machine will seemingly be much less impacted than users who operate with administrative privileges.”

A predominant flaw (CVE-2020-1181) in SharePoint server used to be also mounted, stemming from the server failing to properly identify and filter unsafe ASP.Fetch web controls. The flaw can be abused by an authenticated, remote user who invokes a specially crafted page on an affected version of Microsoft SharePoint Server, allowing them to rating code.

Microsoft also issued updates addressing Dwelling windows 10, 8.1 and Dwelling windows Server variations suffering from a serious, affirm-after-free Adobe Flash Participant flaw (CVE-2020-9633).  Essentially based completely on Microsoft, “In a web based completely assault space the place the user is the affirm of Net Explorer for the desktop, an attacker may perhaps perhaps perhaps host a specially crafted web page that is designed to affirm any of these vulnerabilities via Net Explorer after which convince a user to note the earn web page online.”

Meanwhile, Adobe earlier on Tuesday released patches for four serious flaws in Flash Participant and in its Framemaker listing processor as portion of its on a original basis scheduled updates. The bugs, if exploited, may perhaps perhaps perhaps enable arbitrary code-execution.

Proceed…