Microsoft Issues Patches for 3 Bugs Exploited as Zero-Day in the Wild

Microsoft today released^[1] the latest batch of
software security updates for all supported versions of its Windows
operating systems and other products that patch a total of 113 new
security vulnerabilities, 17 of which are critical and 96 rated
important in severity.

Patches for 4 Zero-Days Exploited In the Wild

Most importantly, two of the security
flaws^[2] have been reported as
being publicly known at the time of release, and the 3 are being
actively exploited in the wild by hackers.
One of the publicly disclosed flaws, which was also exploited as
zero-day, resides in the Adobe Font Manager Library used by
Windows, the existence of which Microsoft revealed last month
within an early security warning for its millions of users.

Tracked as CVE-2020-1020^[3], the remote code
execution vulnerability exists in Microsoft Windows when the
Windows Adobe Type Manager Library improperly handles a
specially-crafted multi-master font – Adobe Type 1 PostScript
format.

As explained in the previous
post^[4], the affected font
library not only parses content when open with a 3rd-party software
but also is used by Windows Explorer to display the content of a
file in the ‘Preview Pane’ or ‘Details Pane’ without having users
to open it.

The second in-the-wild exploited remote code execution flaw
(CVE-2020-0938^[5]) also resides in the
Adobe Type Manager Library that triggers when parsing a malicious
OpenType font.

Both of these zero-day flaws were reported^[6] to Microsoft in the last
week of March by researchers working with Google Project Zero but
with a very short full disclosure deadline, which was then mutually
extended considering the current global circumstances.

The third zero-day is an elevation of privilege vulnerability
(CVE-2020-1027^[7]) in Windows kernel,
discovered by the Google Project Zero team, that impacts all
supported versions of the Windows operating system—including
Windows 10, 8.1 and Server 2008, 2012, 2016, and 2019 editions, as
well as Windows 7 for which Microsoft ended its support in January
2020.

Other New Bugs Microsoft Patched this Month

The second publicly known issue, which was not exploited in the
wild, is an important elevation of privilege vulnerability (CVE-2020-0935^[8]) that resides in the
OneDrive for Windows desktop.

The latest update also includes patches for 5 critical flaws
that affect Microsoft Office SharePoint, 4 of which exists due to
the failure of the software to check the source markup of an
application package, allowing remote attackers to execute arbitrary
code on the affected machines.

Whereas, the 5th SharePoint flaw is a cross-site-scripting (XSS)
issue (CVE-2020-0927) that can be exploited by an
authenticated attacker by sending a specially crafted request to an
affected SharePoint server.

There’s another notable flaw, tracked
as CVE-2020-0910 and rated critical, that affects
Windows Hyper-V, allowing a guest virtual machine to compromise the
hypervisor, escaping from a guest virtual machine to the host, or
escaping from one guest virtual machine to another guest virtual
machine.

Besides these, other critical flaws Microsoft patched this month
affect Chakra scripting engine, Microsoft Dynamics 365 Business
Central, media foundation, graphics components, codecs library and
VBScript—all leading to remote code execution attacks.

Windows users and system administrators are highly advised to
apply the latest security patches as soon as possible in an attempt
to keep cybercriminals and hackers away from taking control of
their computers.

For installing the latest Windows security updates, you can head
on to Settings → Update & Security → Windows Update → Check for
updates on your PC, or you can install the updates
manually.