Update Microsoft Windows Systems to Patch 99 New Security Flaws

According to the advisories, 12 of the total issues patched by
the tech giant this month are critical in severity, and the
remaining 87 have been listed as important.

Five of the bugs are listed as publicly known at the time of
release, four of which are important in severity and one critical
(CVE-2020-0674^[1]) that is also listed as
under active attack.

Microsoft warned about this zero-day
vulnerability in Internet Explorer (IE) browser last
month when it released an advisory without releasing a patch for
millions of its affected users.
^[2]

As explained previously, this flaw could allow a remote attacker to
execute arbitrary code on targeted computers and take full control
over them just by convincing victims into opening a maliciously
crafted web page on the vulnerable Microsoft browser.

All supported versions of Microsoft Windows also contain a
critical RCE
flaw^[3] (CVE-2020-0662) that an
attacker with a domain user account can exploit to execute
arbitrary code on the targeted system with elevated
permissions.

Remote Desktop Client also contains two critical issues,
tracked as CVE-2020-0681 and CVE-2020-0734, which are not wormable
bugs but could be used to compromise vulnerable systems when
connected to a malicious or untrusted server.

“To exploit this vulnerability, an attacker would need to have
control of a server and then convince a user to connect to it. An
attacker would have no way of forcing a user to connect to the
malicious server, they would need to trick the user into connecting
via social engineering, DNS poisoning or using a Man in the
Middle (MITM) technique,” the advisory says.

“An attacker could also compromise a legitimate server, host
malicious code on it, and wait for the user to connect.”

There’s another critical vulnerability (CVE-2020-0729) that
exists in the way Microsoft Windows operating system parses LNK
shortcuts, successful exploitation of which could allow a
remote attacker to execute arbitrary code on the affected system
and take full control of it.

“The attacker could present to the user a removable drive, or
remote share, that contains a malicious .LNK file and an associated
malicious binary. When the user opens this drive(or remote share)
in Windows Explorer, or any other application that parses the .LNK
file, the malicious binary will execute code of the attacker’s
choice on the target system,” the advisory
says.
^[4]

Besides this, most of the other critical issues are memory
corruption flaws in IE, Edge browser, and Chakra scripting
engine, which, if successfully exploited, could also allow an
unauthenticated, remote attacker to execute arbitrary code on a
targeted system in the context of the current user.

To be noted, there’s an important security feature bypass
issue (CVE-2020-0689^[5]) that poses a
significant threat to security-conscious users. According to
Microsoft, there’s a vulnerability in the secure boot feature that
could let an attacker bypass it and load untrusted software on the
system.

The latest updates also contain patches for multiple
privilege escalation vulnerabilities affecting versions of
the Windows operating system, which could let low privileged
attackers run arbitrary code in kernel mode.

Users and system administrators are highly recommended to apply
the latest security patches as soon as possible to keep
cybercriminals and hackers away from taking control of their
computers.

For installing the latest security updates, you can head on to
Settings → Update & Security → Windows Update → Check for updates
on your computer, or you can install the updates manually.