Overview
Microsoft released August 2020 security updates on Tuesday which fix 120 vulnerabilities ranging from simple spoofing attacks to remote code execution in various products, including .NET Framework, ASP.NET, Internet Explorer, Microsoft Dynamics, Microsoft Edge, Microsoft Graphics Component, Microsoft JET Database Engine, Microsoft Office, Microsoft Office SharePoint, Microsoft Scripting Engine, Microsoft Video Control, Microsoft Windows, Microsoft Windows Codecs Library, Netlogon, SQL Server, Visual Studio, Windows AI, Windows COM, Windows Kernel, Windows Media, Windows Media Player, Windows Print Spooler Components, Windows RDP, Windows Registry, Windows Shell, Windows Update Stack, and Windows WalletService.
Description of Critical Vulnerabilities
This time, Microsoft fixes 16 critical vulnerabilities and 103 important vulnerabilities, two of which have been reported to be exploited. All users are advised to install updates without delay.
- Microsoft Media Foundation
The vulnerabilities (CVE-2020-1379, CVE-2020-1477, CVE-2020-1492, CVE-2020-1525, and CVE-2020-1554) allows an attacker to corrupt memory in certain ways and thereby remotely execute arbitrary code on the victim’s system.An attacker could exploit the vulnerabilities by convincing a target user to open a specially crafted document or webpage.
Vulnerability reference links:
- Windows Signature Authentication Bypass
The vulnerability (CVE-2020-1464) allows an attacker to perform specific operations on a target system and thereby bypass Windows’s signature mechanism to upload malicious programs or files.
The vulnerability has been exploited in the wild. Users are advised to update as soon as possible.
Vulnerability reference link:
- Microsoft Scripting Engine
The vulnerabilities (CVE-2020-1380, and CVE-2020-1555) allows an attacker to corrupt memory in certain ways and thereby remotely execute arbitrary code on the victim’s system.
The vulnerability (CVE-2020-1380) has been exploited in the wild. Users are advised to update as soon as possible.
Vulnerability reference links:
- Microsoft’s Netlogon Remote Protocol
Microsoft’s Netlogon Remote Protocol contains a remote code execution vulnerability (CVE-2020-1472).An attacker could run a specially crafted application on a device connected to the network of a target user, thereby executing arbitrary code.After the month’s updates, users are advised to configure the enhanced model of Domain Controller.
Vulnerability reference link:
More vulnerability information is summarized as follows:
| Product | CVE ID | CVE Title | Severity |
| .NET Framework | CVE-2020-1476 | ASP.NET and .NET Privilege Escalation Vulnerability | Important |
| .NET Framework | CVE-2020-1046 | .NET Framework Remote Code Execution Vulnerability | Critical |
| ASP.NET | CVE-2020-1597 | ASP.NET Core Denial-of-Service Vulnerability | Important |
| Internet Explorer | CVE-2020-1567 | MSHTML Engine Remote Code Execution Vulnerability | Moderate |
| Microsoft Dynamics | CVE-2020-1591 | Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability | Important |
| Microsoft Edge | CVE-2020-1568 | Microsoft Edge PDF Remote Code Execution Vulnerability | Moderate |
| Microsoft Edge | CVE-2020-1569 | Microsoft Edge Memory Corruption Vulnerability | Important |
| Microsoft Graphics Component | CVE-2020-1510 | Win32k Information Disclosure Vulnerability | Important |
| Microsoft Graphics Component | CVE-2020-1529 | Windows GDI Privilege Escalation Vulnerability | Important |
| Microsoft Graphics Component | CVE-2020-1561 | Microsoft Graphics Components Remote Code Execution Vulnerability | Important |
| Microsoft Graphics Component | CVE-2020-1562 | Microsoft Graphics Components Remote Code Execution Vulnerability | Important |
| Microsoft Graphics Component | CVE-2020-1577 | DirectWrite Information Disclosure Vulnerability | Important |
| Microsoft JET Database Engine | CVE-2020-1473 | Jet Database Engine Remote Code Execution Vulnerability | Important |
| Microsoft JET Database Engine | CVE-2020-1557 | Jet Database Engine Remote Code Execution Vulnerability | Important |
| Microsoft JET Database Engine | CVE-2020-1558 | Jet Database Engine Remote Code Execution Vulnerability | Important |
| Microsoft JET Database Engine | CVE-2020-1564 | Jet Database Engine Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-1483 | Microsoft Outlook Memory Corruption Vulnerability | Critical |
| Microsoft Office | CVE-2020-1493 | Microsoft Outlook Information Disclosure Vulnerability | Important |
| Microsoft Office | CVE-2020-1494 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-1495 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-1496 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-1497 | Microsoft Excel Information Disclosure Vulnerability | Important |
| Microsoft Office | CVE-2020-1498 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-1502 | Microsoft Word Information Disclosure Vulnerability | Important |
| Microsoft Office | CVE-2020-1503 | Microsoft Word Information Disclosure Vulnerability | Important |
| Microsoft Office | CVE-2020-1504 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-1563 | Microsoft Office Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-1581 | Microsoft Office Click-to-Run Privilege Escalation Vulnerability | Important |
| Microsoft Office | CVE-2020-1582 | Microsoft Access Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-1583 | Microsoft Word Information Disclosure Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-1499 | Microsoft SharePoint Spoofing Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-1500 | Microsoft SharePoint Spoofing Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-1501 | Microsoft SharePoint Spoofing Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-1505 | Microsoft SharePoint Information Disclosure Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-1573 | Microsoft Office SharePoint XSS Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-1580 | Microsoft Office SharePoint XSS Vulnerability | Important |
| Microsoft Scripting Engine | CVE-2020-1380 | Scripting Engine Memory Corruption Vulnerability | Moderate |
| Microsoft Scripting Engine | CVE-2020-1555 | Scripting Engine Memory Corruption Vulnerability | Critical |
| Microsoft Scripting Engine | CVE-2020-1570 | Scripting Engine Memory Corruption Vulnerability | Moderate |
| Microsoft Video Control | CVE-2020-1492 | Media Foundation Memory Corruption Vulnerability | Critical |
| Microsoft Windows | CVE-2020-1464 | Windows Spoofing Vulnerability | Important |
| Microsoft Windows | CVE-2020-1470 | Windows Work Folders Service Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1509 | Local Security Authority Subsystem Service Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1516 | Windows Work Folders Service Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1517 | Windows File Server Resource Management Service Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1518 | Windows File Server Resource Management Service Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1519 | Windows UPnP Device Host Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1520 | Windows Font Driver Host Remote Code Execution Vulnerability | Important |
| Microsoft Windows | CVE-2020-1526 | Windows Network Connection Broker Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1527 | Windows Custom Protocol Engine Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1528 | Windows Radio Manager API Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1530 | Windows Remote Access Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1534 | Windows Backup Service Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1535 | Windows Backup Engine Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1536 | Windows Backup Engine Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1537 | Windows Remote Access Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1538 | Windows UPnP Device Host Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1539 | Windows Backup Engine Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1540 | Windows Backup Engine Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1541 | Windows Backup Engine Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1542 | Windows Backup Engine Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1543 | Windows Backup Engine Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1544 | Windows Backup Engine Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1545 | Windows Backup Engine Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1546 | Windows Backup Engine Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1547 | Windows Backup Engine Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1549 | Windows CDP User Components Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1550 | Windows CDP User Components Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1383 | Windows RRAS Service Information Disclosure Vulnerability | Important |
| Microsoft Windows | CVE-2020-1459 | Windows ARM Information Disclosure Vulnerability | Important |
| Microsoft Windows | CVE-2020-1467 | Windows Hard Link Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1475 | Windows Server Resource Management Service Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1480 | Windows GDI Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1484 | Windows Work Folders Service Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1485 | Windows Image Acquisition Service Information Disclosure Vulnerability | Important |
| Microsoft Windows | CVE-2020-1486 | Windows Kernel Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1488 | Windows AppX Deployment Extensions Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1489 | Windows CSC Service Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1490 | Windows Storage Service Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1511 | Connected User Experiences and Telemetry Service Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1512 | Windows State Repository Service Information Disclosure Vulnerability | Important |
| Microsoft Windows | CVE-2020-1513 | Windows CSC Service Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1515 | Windows Telephony Server Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1551 | Windows Backup Engine Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1552 | Windows Work Folder Service Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1553 | Windows Runtime Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1566 | Windows Kernel Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1579 | Windows Function Discovery SSDP Provider Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1584 | Windows dnsrslvr.dll Privilege Escalation Vulnerability | Important |
| Microsoft Windows | CVE-2020-1587 | Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2020-1560 | Microsoft Windows Codecs Library Remote Code Execution Vulnerability | Critical |
| Microsoft Windows Codecs Library | CVE-2020-1574 | Microsoft Windows Codecs Library Remote Code Execution Vulnerability | Critical |
| Microsoft Windows Codecs Library | CVE-2020-1585 | Microsoft Windows Codecs Library Remote Code Execution Vulnerability | Critical |
| Netlogon | CVE-2020-1472 | Netlogon Privilege Escalation Vulnerability | Critical |
| SQL Server | CVE-2020-1455 | Microsoft SQL Server Management Studio Denial-of-Service Vulnerability | Important |
| Visual Studio | CVE-2020-0604 | Visual Studio Code Remote Code Execution Vulnerability | Important |
| Windows AI | CVE-2020-1521 | Windows Speech Runtime Privilege Escalation Vulnerability | Important |
| Windows AI | CVE-2020-1522 | Windows Speech Runtime Privilege Escalation Vulnerability | Important |
| Windows AI | CVE-2020-1524 | Windows Speech Shell Components Privilege Escalation Vulnerability | Important |
| Windows COM | CVE-2020-1474 | Windows Image Acquisition Service Information Disclosure Vulnerability | Important |
| Windows Kernel | CVE-2020-1417 | Windows Kernel Privilege Escalation Vulnerability | Important |
| Windows Kernel | CVE-2020-1479 | DirectX Privilege Escalation Vulnerability | Important |
| Windows Kernel | CVE-2020-1578 | Windows Kernel Information Disclosure Vulnerability | Important |
| Windows Media | CVE-2020-1525 | Media Foundation Memory Corruption Vulnerability | Critical |
| Windows Media | CVE-2020-1379 | Media Foundation Memory Corruption Vulnerability | Critical |
| Windows Media | CVE-2020-1339 | Windows Media Remote Code Execution Vulnerability | Critical |
| Windows Media | CVE-2020-1487 | Media Foundation Information Disclosure Vulnerability | Important |
| Windows Media | CVE-2020-1554 | Media Foundation Memory Corruption Vulnerability | Critical |
| Windows Media Player | CVE-2020-1477 | Media Foundation Memory Corruption Vulnerability | Critical |
| Windows Media Player | CVE-2020-1478 | Media Foundation Memory Corruption Vulnerability | Important |
| Windows Print Spooler Components | CVE-2020-1337 | Windows Print Spooler Privilege Escalation Vulnerability | Important |
| Windows RDP | CVE-2020-1466 | Windows Remote Desktop Gateway (RD Gateway) Denial-of-Service Vulnerability | Important |
| Windows Registry | CVE-2020-1377 | Windows Registry Privilege Escalation Vulnerability | Important |
| Windows Registry | CVE-2020-1378 | Windows Registry Privilege Escalation Vulnerability | Important |
| Windows Shell | CVE-2020-1531 | Windows Accounts Control Privilege Escalation Vulnerability | Important |
| Windows Shell | CVE-2020-1565 | Windows Privilege Escalation Vulnerability | Important |
| Windows Update Stack | CVE-2020-1548 | Windows WaasMedic Service Information Disclosure Vulnerability | Important |
| Windows Update Stack | CVE-2020-1571 | Windows Setup Privilege Escalation Vulnerability | Important |
| Windows WalletService | CVE-2020-1533 | Windows WalletService Privilege Escalation Vulnerability | Important |
| Windows WalletService | CVE-2020-1556 | Windows WalletService Privilege Escalation Vulnerability | Important |
Recommended Mitigation Measures
Microsoft has released security updates to fix these issues. Please download and install them as soon as possible.
Statement
This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.
About NSFOCUS
NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.
NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA).
A wholly owned subsidiary of NSFOCUS Technologies Group Co., Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.
Link to full version:
