Patchday October 2020

Microsoft

Microsoft published 87 CVEs in October, of which 11 are categorised as critical and 75 as important, one as moderately severe. No vulnerability is considered active. However, 6 were listed as publicly known at the time of publication.

The security updates affect the following software:

Microsoft Windows
Microsoft Office and Microsoft Office Services and Web Apps
Microsoft JET Database Engine
Azure Functions
Open Source Software
Microsoft Exchange Server
Visual Studio
PowerShellGet
Microsoft .NET Framework
Microsoft Dynamics
Adobe Flash Player
Microsoft Windows Codecs Library

For the 6 CVEs classified as publicly known: patch as soon as possible!

Max Mustermann

CVE-2020-16937 | .NET Framework Information Disclosure Vulnerability: Attackers could disclose the contents of the memory of an affected system.

CVE-2020-16909 | Windows Error Reporting Elevation of Privilege Vulnerability: Attackers could gain access to confidential information and system functions. According to the ZERO DAY INITIATIVE, this CVE is listed as not publicly exploited, but links to attacks that have taken place "in the wild" have been reported.

CVE-2020-16901| Windows Kernel Information Disclosure Vulnerability: Attackers can obtain information that can be used to further compromise the victim's system.

CVE-2020-16938 | Windows Kernel Information Disclosure Vulnerability: Attackers could not execute code or elevate user privileges directly, but they could obtain additional information to further compromise the system.

CVE-2020-16908 | Windows Setup Elevation of Privilege Vulnerability: Attackers could execute arbitrary code with system privileges and then install programs, view, modify or delete data, and create new accounts with full user privileges.

CVE-2020-16885 | Windows Storage VSP Driver Elevation of Privilege Vulnerability: Attackers could gain elevated privileges and run a specially crafted application.

The ZERO DAY INITIATIVE and Microsoft are providing all further information on the other CVEs and links to the downloads of the security updates.

Adobe

Adobe is only releasing one patch in October. The vulnerability CVE-2020-9746 in Flash Player fixes a NULL pointer dereference flaw. This vulnerability could lead to an exploitable crash. As the programme reaches end-of-life (EOL) at the end of this year, this could be the last patch for the player.

SAP

SAP published 15 security advisories in October. Of these, 2 were categorised as "Hot News", 7 as "High", some as "Medium" and one as "Low". CVE-2020-6364 received the highest possible score of 10! It affects SAP Solution Manager and SAP Focused Run. Attackers could inject commands and also execute them. SAP provides registered users with updates and detailed security notes.

The effects of unpatched security vulnerabilities can have dramatic consequences.

On Patchday in September, we emphasised the urgency of closing security vulnerabilities as quickly as possible. Because if the gaps are not patched as quickly as possible, the consequences can be fatal!

Shortly afterwards, media reports followed about a cyberattack on a university hospital in North Rhine-Westphalia. It took several days to solve the problem. During this time, operations had to be cancelled and emergency patients had to be treated in other hospitals. The attackers used a security vulnerability to gain access to a server.

They also left a blackmail letter there, but it was not addressed to the university hospital.

After the investigators informed the blackmailers of this and pointed out the consequences, the hackers withdrew the blackmail. Not only that, but they also sent the key to unlock it. The Ministry of Justice in NRW assumes that there was a mix-up, which unfortunately does not minimise the dramatic consequences. The fact that the ambulances had to travel to other clinics during this time and therefore took longer to arrive meant that one patient could not be treated in time and died on arrival.

The exploited vulnerability, which affects a programme from the company Citrix, has been known for a long time, according to a BSI press release. BSI President Arne Schönbohm explains:

re

"Back in January, we warned about the vulnerability and pointed out the potential consequences of exploiting it. Attackers gain access to internal networks and systems and can still paralyse them months later. I can only urge you not to ignore or postpone such warnings, but to take appropriate measures immediately. The incident shows once again how seriously this danger must be taken. This is another reason why the German government has stipulated in the draft Hospital Future Act that at least 15 per cent of the funding applied for must be used for measures to improve information security."

Max Mustermann

Read here to find out more.

In an update from 23 September. September KOMMUNAL reported that the first traces lead to Russia. The malware "Doppel Paymer" is presumably an encryption Trojan that has already been used by Russian hackers in other cases.

‍

Check back soon when it says: It's Time for Patchday! The next one will take place on 10 November.