Microsoft Releases Windows Security Updates For Critical Flaws

Microsoft formally released fixes for 112 newly discovered
security vulnerabilities as part of its November 2020 Patch Tuesday^[1], including an actively
exploited zero-day flaw disclosed by Google’s security team last
week.

The rollout addresses flaws, 17 of which are rated as Critical,
93 are rated as Important, and two are rated Low in severity, once
again bringing the patch count over 110 after a drop last
month.

The security updates encompass a range of software, including
Microsoft Windows, Office and Office Services and Web Apps,
Internet Explorer, Edge, ChakraCore, Exchange Server, Microsoft
Dynamics, Windows Codecs Library, Azure Sphere, Windows Defender,
Microsoft Teams, and Visual Studio.

Chief among those fixed is CVE-2020-17087^[2]
(CVSS score 7.8), a buffer overflow flaw in Windows Kernel
Cryptography Driver (“cng.sys”) that was disclosed on October 30^[3]
by the Google Project Zero team as being used in conjunction with a
Chrome zero-day to compromise Windows 7 and Windows 10 users.

For its part, Google released an update for its Chrome browser
to address the zero-day (CVE-2020-15999) last month.

Microsoft’s advisory about the flaw doesn’t go into any details
beyond the fact that it was a “Windows Kernel Local Elevation of
Privilege Vulnerability” in part to restructure security advisories^[4] in line with the Common
Vulnerability Scoring System (CVSS) format starting this month.

Outside of the zero-day, the update fixes a number of remote
code execution (RCE) vulnerabilities impacting Exchange Server
(CVE-2020-17084^[5]), Network File System
(CVE-2020-17051^[6]), and Microsoft Teams
(CVE-2020-17091^[7]), as well as a security
bypass flaw in Windows Hyper-V virtualization software (CVE-2020-17040^[8]).

CVE-2020-17051 is rated 9.8 out of a maximum 10 on the CVSS
score, making it a critical vulnerability. Microsoft, however,
noted that the attack complexity of the flaw — the conditions
beyond the attacker’s control that must exist in order to exploit
the vulnerability — is low.

As with the zero-day, the advisories associated with these
security shortcomings are light on descriptions, with little to no
information on how these RCE flaws are abused or which security
feature in Hyper-V is being bypassed.

Other critical flaws fixed by Microsoft this month include
memory corruption vulnerabilities in Microsoft Scripting Engine
(CVE-2020-17052) and Internet Explorer (CVE-2020-17053), and
multiple RCE flaws in HEVC Video Extensions Codecs library.

It’s highly recommended that Windows users and system
administrators apply the latest security patches to resolve the
threats associated with these issues.

To install the latest security updates, Windows users can head
to Start > Settings > Update & Security > Windows Update,
or by selecting Check for Windows updates.