Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 47 vulnerabilities that were fixed in 8 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 8 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Internet Explorer Security Update for January 2020

  Severity

  Critical 4

  Qualys ID

  100399

  Vendor Reference

  CVE-2020-0640

  CVE Reference

  CVE-2020-0640

  CVSS Scores

  Base 7.6 / Temporal 5.6

  Description

  Microsoft releases the security update for Internet Explorer January 2020

  The KB Articles associated with the update:
  KB4534283
  KB4534251
  KB4534303
  KB4534293
  KB4534273
  KB4534276
  KB4528760
  KB4534306
  KB4534271
  KB4534310
  KB4534297
  

  QID Detection Logic:Authenticated
  This QID checks for the file version of Mshtml.dll

  The following versions with their corresponding KBs are verified:
  KB4534283 - 10.0.9200.22950
  KB4534251 - 9.0.8112.21402,10.0.9200.22949,11.0.9600.19597
  KB4534303 - 9.0.8112.21402
  KB4534293 - 11.0.17134.1130
  KB4534273 - 11.0.17763.831
  KB4534276 - 11.0.16299.1565
  KB4528760 - 11.0.18362.592
  KB4534306 - 11.0.10240.18452
  KB4534271 - 11.0.14393.3383
  KB4534310 - 11.0.9600.19597
  KB4534297 - 11.0.9600.19597

  Consequence

  An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Please refer to the CVE-2020-0640 for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-0640

• Microsoft Office and Microsoft Office Services and Web Apps Security Update January 2020

  Severity

  Critical 4

  Qualys ID

  110343

  Vendor Reference

  KB4484217, KB4484221, KB4484223, KB4484227, KB4484234, KB4484236, KB4484243

  CVE Reference

  CVE-2020-0647, CVE-2020-0650, CVE-2020-0651, CVE-2020-0652, CVE-2020-0653

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  Microsoft has released January 2020 security updates to fix multiple security vulnerabilities.

  This security update contains the following KBs:
  KB4484217
  KB4484243
  KB4484234
  KB4484223
  KB4484221
  KB4484236
  KB4484227
  

  QID Detection Logic:
  This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.

  Consequence

  Successful exploitation allows an attacker to execute code remotely.

  Solution

  Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Office and Microsoft Office Services and Web Apps Security Update January 2020

• Microsoft Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601)

  Severity

  Critical 4

  Qualys ID

  91595

  Vendor Reference

  CVE-2020-0601

  CVE Reference

  CVE-2020-0601

  CVSS Scores

  Base 5.8 / Temporal 4.8

  Description

  A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.

  The security update addresses the vulnerability by ensuring that Windows CryptoAPI completely validates ECC certificates.

  The KB Articles associated with the update:
  KB4528760
  KB4534271
  KB4534273
  KB4534276
  KB4534293
  KB4534306
  

  QID Detection Logic (Authenticated):
  

  The following versions of "crypt32.dll" with their corresponding KBs are verified:
  KB4528760 - 10.0.18362.592
  KB4534271 - 10.0.14393.3442
  KB4534273 - 10.0.17763.973
  KB4534276 - 10.0.16299.1622
  KB4534293 - 10.0.17134.1246
  KB4534306 - 10.0.10240.18452
  

  Consequence

  An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. The user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider.

  A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software.

  Solution

  Please refer to the CVE-2020-0601 for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Update Guide Windows(CryptoAPI)

• Microsoft Windows Security Update for January 2020

  Severity

  Critical 4

  Qualys ID

  91596

  Vendor Reference

  KB4528760, KB4534271, KB4534273, KB4534276, KB4534283, KB4534288, KB4534293, KB4534297, KB4534303, KB4534306, KB4534309, KB4534310, KB4534312, KB4534314

  CVE Reference

  CVE-2020-0607, CVE-2020-0608, CVE-2020-0609, CVE-2020-0610, CVE-2020-0611, CVE-2020-0612, CVE-2020-0613, CVE-2020-0614, CVE-2020-0615, CVE-2020-0616, CVE-2020-0617, CVE-2020-0620, CVE-2020-0621, CVE-2020-0622, CVE-2020-0623, CVE-2020-0624, CVE-2020-0625, CVE-2020-0626, CVE-2020-0627, CVE-2020-0628, CVE-2020-0629, CVE-2020-0630, CVE-2020-0631, CVE-2020-0632, CVE-2020-0633, CVE-2020-0634, CVE-2020-0635, CVE-2020-0636, CVE-2020-0637, CVE-2020-0638, CVE-2020-0639, CVE-2020-0641, CVE-2020-0642, CVE-2020-0643, CVE-2020-0644

  CVSS Scores

  Base 10 / Temporal 8.3

  Description

  Microsoft releases the security update for Windows January 2020

  The KB Articles associated with the update:
  KB4528760
  KB4534271
  KB4534273
  KB4534276
  KB4534283
  KB4534288
  KB4534293
  KB4534297
  KB4534303
  KB4534306
  KB4534309
  KB4534310
  KB4534312
  KB4534314
  

  QID Detection Logic (Authenticated):
  

  This QID checks for the file version of "ntoskrnl.exe". For KB4534309, KB4534297, KB4534288 and KB4534283, This QID checks file version of "User32.dll"

  Consequence

  An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. The user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider.

  Solution

  Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Update Guide

• Microsoft Windows Servicing Stack Security Update January 2020

  Severity

  Medium 2

  Qualys ID

  91597

  Vendor Reference

  KB4528759, KB4536952, KB4536953

  CVE Reference

  N/A

  CVSS Scores

  Base 6.8 / Temporal 5

  Description

  Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes.

  Microsoft has released Servicing Stack security updates for Windows 2008, Windows 7, Windows 2008 R2, Windows 10 1903, and Windows 10 1909.

  QID Detection Logic (Authenticated):
  This authenticated QID will check for file version of CbsCore.dll

  Consequence

  Successful exploitation may allow unauthorized disclosure of information, unauthorized modification or disruption of service.

  Solution

  Customers are advised to refer to advisory ADV990001 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  ADV990001

• Microsoft .NET Framework Security Updates for January 2020

  Severity

  Urgent 5

  Qualys ID

  91598

  Vendor Reference

  KB4532933, KB4532935, KB4532936, KB4532937, KB4532947, KB4534293, KB4534306, KB4534976, KB4534977, KB4534978, KB4535101, KB4535102, KB4535103, KB4535104, KB4535105, KB4537572

  CVE Reference

  CVE-2020-0605, CVE-2020-0606, CVE-2020-0646

  CVSS Scores

  Base 10 / Temporal 7.8

  Description

  A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.
  A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly.
  

  KB4532933,KB4532935,KB4532936,KB4537572,KB4534293,KB4534306,KB4534976,KB4534977,KB4534978,KB4534979,KB4535101,KB4535102,KB4535103,KB4535104,KB4535105,KB4532947 kbs are covered.
  This security update is rated Critical for supported versions of Microsoft .NET Framework.

  QID Detection Logic (Authenticated):
  - Checks for vulnerable version of system.core.dll, system.printing.dll files

  Consequence

  Successful exploitation allows attackers to take control of the affected system.

  Solution

  Customers are advised to refer to CVE-2020-0605, CVE-2020-0606, CVE-2020-0646 for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-0605
  CVE-2020-0606
  CVE-2020-0646

• Microsoft ASP.NET Core Security Update January 2020

  Severity

  Critical 4

  Qualys ID

  91599

  Vendor Reference

  CVE-2020-0602

  CVE Reference

  CVE-2020-0602, CVE-2020-0603

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

  Affected Versions:
  ASP.NET Core 2.1 prior to 2.1.15.
  ASP.NET Core 3.0 prior to 3.0.1.
  ASP.NET Core 3.1 prior to 3.1.1.

  QID Detection Logic (Authenticated):
  This QID checks for the vulnerable version of Microsoft.AspNetCore.App and Microsoft.AspNetCore.All
  

  Consequence

  An attacker who successfully exploited this vulnerability could install programs;,view, change, or delete data; or create new accounts with full user rights.

  Solution

  Microsoft has released an update. Please refer to vendor security advisory CVE-2020-0603 and CVE-2020-0602 for more information.
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-0602
  CVE-2020-0603

• Microsoft .NET Core Security Update January 2020

  Severity

  Critical 4

  Qualys ID

  91600

  Vendor Reference

  CVE-2020-0605, CVE-2020-0606

  CVE Reference

  CVE-2020-0605, CVE-2020-0606

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  .NET Core is a general purpose development platform maintained by Microsoft and the .NET community on GitHub. It is cross-platform, supporting Windows, macOS and Linux, and can be used in device, cloud, and embedded/IoT scenarios.

  A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.

  Affected versions
  .NET Core 3.0 prior to 3.0.2
  .NET Core 3.1 prior to 3.1.1

  Qid detection logic:Authenticated
  The qid checks for vulnerable dotnet.dll versions on windows and checks for vulnerable .net core versions.

  Consequence

  An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.

  Solution

  Microsoft has released an update. Please refer to vendor security advisory .NET Core CVE-2020-0605 and .NET Core CVE-2020-0606 for more information.
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-0605
  CVE-2020-0606

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.