Patchday November 2020

Have you recovered from the last patchday yet? Because Tuesday was the day again. Microsoft, Adobe and SAP released their patches for November 2020.

New features in the Microsoft Patchday

With the November Patchday, Microsoft has introduced a new version of the Security Update Guide. The vulnerabilities are now described using the Common Vulnerability Scoring System (CVSS) . According to Microsoft, each vulnerability can now be precisely assessed and described with the respective details.

For more information and a comparison between the old and the new version, please visit Microsoft Blog

According to the Zero Day Initiative however, there is the disadvantage that Microsoft withholds a lot of information and the scope of details about the vulnerabilities is significantly smaller. The assessment of whether the respective vulnerability is relevant for "my" network is only possible from the now missing description.

Dustin Childs from the Zero Day Initiative writes in his blog article:

From Microsoft's perspective, I'm sure they think they know best about how to rate a bug. There have been times when the researcher who found the bug disagreed.

Max Mustermann

So we're curious to see if Microsoft's new version can hold up in the long run...

Microsoft patches

Now we come to the 112 CVEs released by Microsoft in November. This is apparently a volume that we will have to get used to in the future if we compare the figures for the last 8 months. Affected are:

Windows
Office, Office Services and Web Apps
Internet Explorer
Edge (EdgeHTML-based and Chromium-based)
ChakraCore
Exchange Server
Microsoft Dynamics
Azure Sphere
Windows Defender
Microsoft Teams
Visual Studio

17 vulnerabilities were categorised as critical, 93 as important and two as low severity. One bug is listed as publicly known and active: CVE-2020-17087. This bug was announced by Google at the end of October and affects the Windows kernel. It was found to have been combined with a Chrome bug to bypass the browser sandbox with the aim of executing code on the system.

Even while patching the systems, we are not spared from Corona. There is one bug in Microsoft Teams that stands out. Presumably due to the increased use of students in the course of homeschooling.

All listed CVEs with the corresponding patches can be found in the Security Update Guide from Microsoft.

Adobe

Adobe already released emergency patches last week. Namely for Acrobat and Reader. Four of the 14 CVEs were classified as critical, as code could be possible after opening a prepared PDF execution.

Yesterday, Adobe released three patches for Reader for Android and Connect. All Adobe patches in November were not known or active at the time of release.

Adobe provides all necessary security recommendations.

‍SAP

SAP published 12 updates in November. Among them are 6 Hot News. Two vulnerabilities rated level 10 affect the products SAP Solution Manager (JAVA stack, version - 7.2) and SAP Solution Manager (User Experience Monitoring, version - 7.2). The other 4 CVEs classified as Hot News concern these products:

SAP Data Services, Versions - 4.2
SAP S4 HANA(DMIS), Versions - 101, 102, 103, 104, 105
SAP NetWeaver AS JAVA, Versions - 7.20, 7.30, 7.31, 7.40, 7.50
SAP NetWeaver (Knowledge Management); Versions - 7.30, 7.31, 7.40, 7.50

The SAP Support Portal provides all important security updates and other useful information on SAP Patchdays.

‍

Check back soon when it says: It's Time for Patchday! The last one for this year will take place on 8 December!