Microsoft has rolled out its September Patch Tuesday updates this week. Once again, it’s a huge update bundle addressing over a hundred security vulnerabilities. These include no low-severity vulnerability. Though, what’s good this month, unlike August and July updates, is that the bugs include no publicly no or under attack vulnerabilities.
Microsoft Fixed 23 Critical Remote Code Execution Bugs
With September Patch Tuesday, Microsoft has released fixes for 23 different critical security flaws. Upon exploitation, all of these could lead to remote code execution.
One of the notable bugs from the critical severity category is the one affecting the Microsoft Exchange Server. This vulnerability, CVE-2020-16875, existed due to improper validation of cmdlet arguments. An attacker could exploit the bug simply by sending a maliciously crafted email to the target Exchange Server.
As described in Microsoft’s advisory,
An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.
Likewise, another RCE vulnerability, CVE-2020-1129, affected the Microsoft Windows Codecs Library. An adversary would simply need to send a malicious image to the target device to exploit the flaw. In turn, this would allow the attacker to compromise the target system. Also, the same app suffered another similar vulnerability, CVE-2020-1319, that allowed an attacker to take complete control of the target system.
More September Patch Tuesday Updates
Apart from the critical security flaws, the September updates also include fixes for 105 important severity bugs. These vulnerabilities could lead to various results, include remote code execution attacks, elevation of privilege, spoofing, and information disclosure.
One of these includes CVE-2020-0951, a security feature bypass flaw affecting the Windows Defender. Regarding this vulnerability, Microsoft stated,
A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement. An attacker who successfully exploited this vulnerability could execute PowerShell commands that would be blocked by WDAC.
To exploit the vulnerability, an attacker need administrator access on a local machine where PowerShell is running. The attacker could then connect to a PowerShell session and send commands to execute arbitrary code.
Only one low-severity bug also received a fix this month. This security feature bypass flaw, CVE-2020-1044, affected the SQL Server Reporting Services (SSRS).
In all, Microsoft addressed different bugs across 15 different products. Since the criminal hackers keep searching for vulnerable devices to exploit the bugs, all Windows users must ensure updating their systems at the earliest.