Microsoft’s Security Patches for June 2020 Fix 130 Security Vulnerabilities

Microsoft’s Security Patches for June 2020 Fix 130 Security Vulnerabilities

June 26, 2020 | Mina Hao

Overview  

Microsoft released the June 2020 security patches on Tuesday that fix 130 vulnerabilities ranging from simple spoofing attacks to remote code execution in various products, including Adobe Flash Player, Android App, Apps, Azure DevOps, Diagnostics Hub, HoloLens, Internet Explorer, Microsoft Browsers, Microsoft Edge, Microsoft Edge (Chromium-based) in IE Mode, Microsoft Graphics Component, Microsoft JET Database Engine, Microsoft Malware Protection Engine, Microsoft Office, Microsoft Office SharePoint, Microsoft Scripting Engine, Microsoft Windows, Microsoft Windows PDF, Open Source Software, System Center, Visual Studio, Windows COM, Windows Diagnostic Hub, Windows Error Reporting, Windows Installer, Windows Kernel, Windows Lock Screen, Windows Media, Windows Media Player, Windows OLE, Windows Print Spooler Components, Windows Shell, Windows SMB, Windows Update Stack, and Windows Wallet Service.

Description of Critical and Important Vulnerabilities

The security updates fix 8 critical vulnerabilities and 117 important vulnerabilities. Though no exploit is discovered for these vulnerabilities, users are still strongly recommended to install updates as soon as possible.

  • SMB vulnerabilities: CVE-2020-1284, CVE-2020-1206, and CVE-2020-1301 

Of three vulnerabilities in Microsoft Server Message Block (SMB), two reside in SMBv3: a denial-of-service vulnerability (CVE-2020-1284) that can be exploited by authenticated attackers and an information disclosure vulnerability (CVE-2020-1206) that can be exploited without authentication. The vulnerability assigned CVE-2020-1301 is a remote code execution vulnerability that requires authentication in SMBv1.

The vulnerability (CVE-2020-1301) reminds people of EternalBlue which is a remote code execution vulnerability in SMBv1 that is exploited by the WannaCry ransomware. Unlike EternalBlue, this vulnerability can be exploited only be authenticated attackers. In addition, SMBv1 is disabled in Windows 10 by default.

The vulnerability (CVE-2020-1301) affects Windows 7 and Windows Server 2008 for which official support has been unavailable since January 2020. However, patches have been released for the two systems. Since patches are available, users of Windows 7 and Windows Server 2008 are advised to upgrade their system as soon as possible:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1284
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1206
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1301
  • Windows Graphics Device Interface (GDI) remote code execution vulnerability:

Through web-based or file sharing attack scenarios, attackers could exploit the vulnerability (CVE-2020-1248) to entice users to access links or open attachments via a specially crafted malicious website or file. Once a user accesses a malicious website or opens a malicious file, the attacker could take full control of the vulnerable system with privileges of the current logged-in user.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1248
  • Microsoft Excel remote code execution vulnerabilities: CVE-2020-1225, CVE-2020-1226

An attacker could exploit this vulnerability by enticing a user to open a crafted Excel document. Successful exploitation allows attackers to be able to execute remote code in the context of the current user.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1225
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1226
  • Microsoft Word for Android remote code execution vulnerability: CVE-2020-1223

A remote code execution vulnerability in Word of certain Android versions allows attackers to execute arbitrary code remotely. Microsoft recommends that users update their application through Google Play.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1223
  • VBScript remote code execution vulnerabilities: CVE-2020-1214, CVE-2020-1215, CVE-2020-1216, CVE-2020-1230, and CVE-2020-1260

The VBScript engine does not properly handle objects in memory. Attackers could exploit this vulnerability to execute arbitrary code in the context of the current user.

In a web-based attack scenario, an attacker could build a specially crafted website that is designed to exploit the vulnerability through Internet Explorer, and then convince a user to view the website.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1214
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1215
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1216
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1230
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1260
  • LNK remote code execution vulnerability: CVE-2020-1299

Microsoft Windows is prone to a remote code execution vulnerability that allows attackers to execute arbitrary code remotely on the target system via a malicious .LNK file.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1299

Remediation

ProductCVE IDCVE TitleSeverity Level
Adobe Flash PlayerADV200010June 2020 Adobe Flash Security UpdateCritical
Microsoft Office SharePointCVE-2020-1181Microsoft SharePoint Server Remote Code Execution VulnerabilityCritical
Microsoft Scripting EngineCVE-2020-1213VBScript Remote Code Execution VulnerabilityCritical
Microsoft Scripting EngineCVE-2020-1216VBScript Remote Code Execution VulnerabilityCritical
Windows OLECVE-2020-1281Windows OLE Remote Code Execution VulnerabilityCritical
Windows Print Spooler ComponentsCVE-2020-1300Windows Remote Code Execution VulnerabilityCritical
Windows ShellCVE-2020-1286Windows Shell Remote Code Execution VulnerabilityCritical
Windows ShellCVE-2020-1299LNK Remote Code Execution VulnerabilityCritical
Android AppCVE-2020-1223Word for Android Remote Code Execution VulnerabilityImportant
AppsCVE-2020-1329Microsoft Bing Search Spoofing VulnerabilityImportant
Azure DevOpsCVE-2020-1327Azure DevOps Server HTML Injection VulnerabilityImportant
Diagnostics HubCVE-2020-1202Diagnostic Hub Standard Collector Privilege Escalation VulnerabilityImportant
Diagnostics HubCVE-2020-1203Diagnostic Hub Standard Collector Privilege Escalation VulnerabilityImportant
Diagnostics HubCVE-2020-1278Diagnostics Hub Standard Collector Privilege Escalation VulnerabilityImportant
HoloLensCVE-2020-1199Windows Feedback Hub Privilege Escalation VulnerabilityImportant
Microsoft EdgeCVE-2020-1242Microsoft Edge Information Disclosure VulnerabilityImportant
Microsoft Edge (Chromium-based) in IE ModeCVE-2020-1220Microsoft Edge (Chromium-based) in IE Mode Spoofing VulnerabilityImportant
Microsoft Graphics ComponentCVE-2020-0915Windows GDI Privilege Escalation VulnerabilityImportant
Microsoft Graphics ComponentCVE-2020-0916Windows GDI Privilege Escalation VulnerabilityImportant
Microsoft Graphics ComponentCVE-2020-0986Windows Kernel Privilege Escalation VulnerabilityImportant
Microsoft Graphics ComponentCVE-2020-1348Windows GDI Information Disclosure VulnerabilityImportant
Microsoft Graphics ComponentCVE-2020-1207Win32k Privilege Escalation VulnerabilityImportant
Microsoft Graphics ComponentCVE-2020-1160Microsoft Graphics Component Information Disclosure VulnerabilityImportant
Microsoft Graphics ComponentCVE-2020-1251Win32k Privilege Escalation VulnerabilityImportant
Microsoft Graphics ComponentCVE-2020-1253Win32k Privilege Escalation VulnerabilityImportant
Microsoft Graphics ComponentCVE-2020-1258DirectX Privilege Escalation VulnerabilityImportant
Microsoft JET Database EngineCVE-2020-1208Jet Database Engine Remote Code Execution VulnerabilityImportant
Microsoft JET Database EngineCVE-2020-1236Jet Database Engine Remote Code Execution VulnerabilityImportant
Microsoft Malware Protection EngineCVE-2020-1163Microsoft Windows Defender Privilege Escalation VulnerabilityImportant
Microsoft Malware Protection EngineCVE-2020-1170Microsoft Windows Defender Privilege Escalation VulnerabilityImportant
Microsoft OfficeCVE-2020-1225Microsoft Excel Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2020-1226Microsoft Excel Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2020-1229Microsoft Outlook Security Function Bypass VulnerabilityImportant
Microsoft OfficeCVE-2020-1321Microsoft Office Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2020-1322Microsoft Project Information Disclosure VulnerabilityImportant
Microsoft Office SharePointCVE-2020-1183Microsoft Office SharePoint XSS VulnerabilityImportant
Microsoft Office SharePointCVE-2020-1148Microsoft SharePoint Spoofing VulnerabilityImportant
Microsoft Office SharePointCVE-2020-1295Microsoft SharePoint Privilege Escalation VulnerabilityImportant
Microsoft Office SharePointCVE-2020-1298Microsoft Office SharePoint XSS VulnerabilityImportant
Microsoft Office SharePointCVE-2020-1320Microsoft Office SharePoint XSS VulnerabilityImportant
Microsoft Office SharePointCVE-2020-1177Microsoft Office SharePoint XSS VulnerabilityImportant
Microsoft Office SharePointCVE-2020-1178Microsoft SharePoint Server Privilege Escalation VulnerabilityImportant
Microsoft Office SharePointCVE-2020-1289Microsoft SharePoint Spoofing VulnerabilityImportant
Microsoft Office SharePointCVE-2020-1297Microsoft Office SharePoint XSS VulnerabilityImportant
Microsoft Office SharePointCVE-2020-1318Microsoft Office SharePoint XSS VulnerabilityImportant
Microsoft Office SharePointCVE-2020-1323SharePoint Open Redirect VulnerabilityImportant
Microsoft Scripting EngineCVE-2020-1214VBScript Remote Code Execution VulnerabilityImportant
Microsoft Scripting EngineCVE-2020-1215VBScript Remote Code Execution VulnerabilityImportant
Microsoft Scripting EngineCVE-2020-1230VBScript Remote Code Execution VulnerabilityImportant
Microsoft WindowsCVE-2020-1334Windows Runtime Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1196Windows Print Configuration Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1197Windows Error Reporting Manager Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1201Windows Now Playing Session Manager Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1204Windows Mobile Device Management Diagnostics Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1209Windows Network List Service Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1211Connected Devices Platform Service Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1217Windows Runtime Information Disclosure VulnerabilityImportant
Microsoft WindowsCVE-2020-1222Microsoft Store Runtime Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1120Connected User Experiences and Telemetry Service Denial-of-Service VulnerabilityImportant
Microsoft WindowsCVE-2020-1194Windows Registry Denial-of-Service VulnerabilityImportant
Microsoft WindowsCVE-2020-1231Windows Runtime Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1233Windows Runtime Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1234Windows Error Reporting Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1235Windows Runtime Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1246Windows Kernel Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1271Windows Backup Service Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1307Windows Kernel Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1312Windows Installer Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1316Windows Kernel Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1324Windows Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1162Windows Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1241Windows Kernel Security Function Bypass VulnerabilityImportant
Microsoft WindowsCVE-2020-1244Connected User Experiences and Telemetry Service Denial-of-Service VulnerabilityImportant
Microsoft WindowsCVE-2020-1255Windows Background Intelligent Transfer Service Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1259Windows Host Guardian Service Security Function Bypass VulnerabilityImportant
Microsoft WindowsCVE-2020-1263Windows Error Reporting Information Disclosure VulnerabilityImportant
Microsoft WindowsCVE-2020-1268Windows Service Information Disclosure VulnerabilityImportant
Microsoft WindowsCVE-2020-1270Windows WLAN Service Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1283Windows Denial-of-Service VulnerabilityImportant
Microsoft WindowsCVE-2020-1290Win32k Information Disclosure VulnerabilityImportant
Microsoft WindowsCVE-2020-1291Windows Network Connections Service Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1292OpenSSH for Windows Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1305Windows State Repository Service Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1306Windows Runtime Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1309Microsoft Store Runtime Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1313Windows Update Orchestrator Service Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1314Windows Text Service Framework Privilege Escalation VulnerabilityImportant
Microsoft WindowsCVE-2020-1317Group Policy Privilege Escalation VulnerabilityImportant
Microsoft Windows PDFCVE-2020-1248GDI+ Remote Code Execution VulnerabilityImportant
Open Source SoftwareCVE-2020-1340NuGetGallery Spoofing VulnerabilityImportant
System CenterCVE-2020-1331System Center Operations Manager Spoofing VulnerabilityImportant
Visual StudioCVE-2020-1343Visual Studio Code Live Share Information Disclosure VulnerabilityImportant
Windows COMCVE-2020-1311Component Object Model Privilege Escalation VulnerabilityImportant
Windows Diagnostic HubCVE-2020-1257Diagnostics Hub Standard Collector Privilege Escalation VulnerabilityImportant
Windows Diagnostic HubCVE-2020-1293Diagnostics Hub Standard Collector Privilege Escalation VulnerabilityImportant
Windows Error ReportingCVE-2020-1261Windows Error Reporting Information Disclosure VulnerabilityImportant
Windows InstallerCVE-2020-1277Windows Installer Privilege Escalation VulnerabilityImportant
Windows InstallerCVE-2020-1272Windows Installer Privilege Escalation VulnerabilityImportant
Windows InstallerCVE-2020-1302Windows Installer Privilege Escalation VulnerabilityImportant
Windows KernelCVE-2020-1237Windows Kernel Privilege Escalation VulnerabilityImportant
Windows KernelCVE-2020-1247Win32k Privilege Escalation VulnerabilityImportant
Windows KernelCVE-2020-1262Windows Kernel Privilege Escalation VulnerabilityImportant
Windows KernelCVE-2020-1269Windows Kernel Privilege Escalation VulnerabilityImportant
Windows KernelCVE-2020-1274Windows Kernel Privilege Escalation VulnerabilityImportant
Windows KernelCVE-2020-1275Windows Kernel Privilege Escalation VulnerabilityImportant
Windows KernelCVE-2020-1280Windows Bluetooth Service Privilege Escalation VulnerabilityImportant
Windows KernelCVE-2020-1282Windows Runtime Privilege Escalation VulnerabilityImportant
Windows KernelCVE-2020-1310Win32k Privilege Escalation VulnerabilityImportant
Windows KernelCVE-2020-1264Windows Kernel Privilege Escalation VulnerabilityImportant
Windows KernelCVE-2020-1265Windows Runtime Privilege Escalation VulnerabilityImportant
Windows KernelCVE-2020-1266Windows Kernel Privilege Escalation VulnerabilityImportant
Windows KernelCVE-2020-1273Windows Kernel Privilege Escalation VulnerabilityImportant
Windows KernelCVE-2020-1276Windows Kernel Privilege Escalation VulnerabilityImportant
Windows Lock ScreenCVE-2020-1279Windows Lockscreen Privilege Escalation VulnerabilityImportant
Windows MediaCVE-2020-1238Media Foundation Memory Corruption VulnerabilityImportant
Windows MediaCVE-2020-1304Windows Runtime Privilege Escalation VulnerabilityImportant
Windows Media PlayerCVE-2020-1232Media Foundation Information Disclosure VulnerabilityImportant
Windows Media PlayerCVE-2020-1239Media Foundation Memory Corruption VulnerabilityImportant
Windows OLECVE-2020-1212OLE Automation Privilege Escalation VulnerabilityImportant
Windows SMBCVE-2020-1206Windows SMBv3 Client/Server Information Disclosure VulnerabilityImportant
Windows SMBCVE-2020-1284Windows SMBv3 Client/Server Denial-of-Service VulnerabilityImportant
Windows SMBCVE-2020-1301Windows SMB Remote Code Execution VulnerabilityImportant
Windows Update StackCVE-2020-1254Windows Modules Installer Service Privilege Escalation VulnerabilityImportant
Windows Wallet ServiceCVE-2020-1294Windows WalletService Privilege Escalation VulnerabilityImportant
Windows Wallet ServiceCVE-2020-1287Windows WalletService Privilege Escalation VulnerabilityImportant
Internet ExplorerCVE-2020-1315Internet Explorer Information Disclosure VulnerabilityLow
Microsoft BrowsersCVE-2020-1219Microsoft Browser Memory Corruption VulnerabilityModerate
Microsoft Scripting EngineCVE-2020-1073Scripting Engine Memory Corruption VulnerabilityModerate
Microsoft Scripting EngineCVE-2020-1260VBScript Remote Code Execution VulnerabilityModerate
Microsoft WindowsCVE-2020-1296Windows Diagnostics & Feedback Information Disclosure VulnerabilityNone

Recommended Mitigation Measure

Microsoft has released the June 2020 security patches to fix these issues. Please install them as soon as possible.

Statement

This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.

About NSFOCUS

NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.

NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA).

A wholly owned subsidiary of NSFOCUS Technologies Group Co., Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.

Download: