Microsoft security alert.

January 15, 2020

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 47 vulnerabilities that were fixed in 8 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 8 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

  • Microsoft Internet Explorer Security Update for January 2020

    Severity
    Critical 4
    Qualys ID
    100399
    Vendor Reference
    CVE-2020-0640
    CVE Reference
    CVE-2020-0640
    CVSS Scores
    Base 7.6 / Temporal 6.3
    Description
    Microsoft releases the security update for Internet Explorer January 2020

    The KB Articles associated with the update:
    KB4534283
    KB4534251
    KB4534303
    KB4534293
    KB4534273
    KB4534276
    KB4528760
    KB4534306
    KB4534271
    KB4534310
    KB4534297

    QID Detection Logic:Authenticated
    This QID checks for the file version of Mshtml.dll

    The following versions with their corresponding KBs are verified:
    KB4534283 - 10.0.9200.22950
    KB4534251 - 9.0.8112.21402,10.0.9200.22949,11.0.9600.19597
    KB4534303 - 9.0.8112.21402
    KB4534293 - 11.0.17134.1130
    KB4534273 - 11.0.17763.831
    KB4534276 - 11.0.16299.1565
    KB4528760 - 11.0.18362.592
    KB4534306 - 11.0.10240.18452
    KB4534271 - 11.0.14393.3383
    KB4534310 - 11.0.9600.19597
    KB4534297 - 11.0.9600.19597

    Consequence
    An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
    Solution
    Please refer to the CVE-2020-0640 for more information pertaining to these vulnerabilities.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2020-0640

  • Microsoft Office and Microsoft Office Services and Web Apps Security Update January 2020

    Severity
    Critical 4
    Qualys ID
    110343
    Vendor Reference
    KB4484217, KB4484221, KB4484223, KB4484227, KB4484234, KB4484236, KB4484243
    CVE Reference
    CVE-2020-0647, CVE-2020-0650, CVE-2020-0651, CVE-2020-0652, CVE-2020-0653
    CVSS Scores
    Base 9.3 / Temporal 7.7
    Description
    Microsoft has released January 2020 security updates to fix multiple security vulnerabilities.

    This security update contains the following KBs:
    KB4484217
    KB4484243
    KB4484234
    KB4484223
    KB4484221
    KB4484236
    KB4484227

    QID Detection Logic:
    This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.

    Consequence
    Successful exploitation allows an attacker to execute code remotely.

    Solution
    Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Office and Microsoft Office Services and Web Apps Security Update January 2020

  • Microsoft Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601)

    Severity
    Critical 4
    Qualys ID
    91595
    Vendor Reference
    CVE-2020-0601
    CVE Reference
    CVE-2020-0601
    CVSS Scores
    Base 5.8 / Temporal 4.8
    Description
    A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.

    The security update addresses the vulnerability by ensuring that Windows CryptoAPI completely validates ECC certificates.

    The KB Articles associated with the update:
    KB4528760
    KB4534271
    KB4534273
    KB4534276
    KB4534293
    KB4534306

    QID Detection Logic (Authenticated):

    The following versions of "crypt32.dll" with their corresponding KBs are verified:
    KB4528760 - 10.0.18362.592
    KB4534271 - 10.0.14393.3442
    KB4534273 - 10.0.17763.973
    KB4534276 - 10.0.16299.1622
    KB4534293 - 10.0.17134.1246
    KB4534306 - 10.0.10240.18452

    Consequence
    An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. The user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider.

    A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software.

    Solution
    Please refer to the CVE-2020-0601 for more information pertaining to these vulnerabilities.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide Windows(CryptoAPI)

  • Microsoft Windows Security Update for January 2020

    Severity
    Critical 4
    Qualys ID
    91596
    Vendor Reference
    KB4528760, KB4534271, KB4534273, KB4534276, KB4534283, KB4534288, KB4534293, KB4534297, KB4534303, KB4534306, KB4534309, KB4534310, KB4534312, KB4534314
    CVE Reference
    CVE-2020-0607, CVE-2020-0608, CVE-2020-0609, CVE-2020-0610, CVE-2020-0611, CVE-2020-0612, CVE-2020-0613, CVE-2020-0614, CVE-2020-0615, CVE-2020-0616, CVE-2020-0617, CVE-2020-0620, CVE-2020-0621, CVE-2020-0622, CVE-2020-0623, CVE-2020-0624, CVE-2020-0625, CVE-2020-0626, CVE-2020-0627, CVE-2020-0628, CVE-2020-0629, CVE-2020-0630, CVE-2020-0631, CVE-2020-0632, CVE-2020-0633, CVE-2020-0634, CVE-2020-0635, CVE-2020-0636, CVE-2020-0637, CVE-2020-0638, CVE-2020-0639, CVE-2020-0641, CVE-2020-0642, CVE-2020-0643, CVE-2020-0644
    CVSS Scores
    Base 10 / Temporal 8.3
    Description
    Microsoft releases the security update for Windows January 2020

    The KB Articles associated with the update:
    KB4528760
    KB4534271
    KB4534273
    KB4534276
    KB4534283
    KB4534288
    KB4534293
    KB4534297
    KB4534303
    KB4534306
    KB4534309
    KB4534310
    KB4534312
    KB4534314

    QID Detection Logic (Authenticated):

    This QID checks for the file version of "ntoskrnl.exe". For KB4534309, KB4534297, KB4534288 and KB4534283, This QID checks file version of "User32.dll"

    Consequence
    An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. The user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider.
    Solution
    Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide

  • Microsoft Windows Servicing Stack Security Update January 2020

    Severity
    Medium 2
    Qualys ID
    91597
    Vendor Reference
    KB4528759, KB4536952, KB4536953
    CVE Reference
    N/A
    CVSS Scores
    Base 6.8 / Temporal 5
    Description
    Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes.

    Microsoft has released Servicing Stack security updates for Windows 2008, Windows 7, Windows 2008 R2, Windows 10 1903, and Windows 10 1909.

    QID Detection Logic (Authenticated):
    This authenticated QID will check for file version of CbsCore.dll

    Consequence
    Successful exploitation may allow unauthorized disclosure of information, unauthorized modification or disruption of service.

    Solution
    Customers are advised to refer to advisory ADV990001 for more information.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    ADV990001

  • Microsoft .NET Framework Security Updates for January 2020

    Severity
    Urgent 5
    Qualys ID
    91598
    Vendor Reference
    KB4532933, KB4532935, KB4532936, KB4532937, KB4532947, KB4534293, KB4534306, KB4534976, KB4534977, KB4534978, KB4535101, KB4535102, KB4535103, KB4535104, KB4535105, KB4537572
    CVE Reference
    CVE-2020-0605, CVE-2020-0606, CVE-2020-0646
    CVSS Scores
    Base 10 / Temporal 7.8
    Description
    A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.
    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly.

    KB4532933,KB4532935,KB4532936,KB4537572,KB4534293,KB4534306,KB4534976,KB4534977,KB4534978,KB4534979,KB4535101,KB4535102,KB4535103,KB4535104,KB4535105,KB4532947 kbs are covered.
    This security update is rated Critical for supported versions of Microsoft .NET Framework.

    QID Detection Logic (Authenticated):
    - Checks for vulnerable version of system.core.dll, system.printing.dll files

    Consequence
    Successful exploitation allows attackers to take control of the affected system.
    Solution
    Customers are advised to refer to CVE-2020-0605, CVE-2020-0606, CVE-2020-0646 for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2020-0605
    CVE-2020-0606
    CVE-2020-0646

  • Microsoft ASP.NET Core Security Update January 2020

    Severity
    Critical 4
    Qualys ID
    91599
    Vendor Reference
    CVE-2020-0602
    CVE Reference
    CVE-2020-0602, CVE-2020-0603
    CVSS Scores
    Base 9.3 / Temporal 6.9
    Description
    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Affected Versions:
    ASP.NET Core 2.1 prior to 2.1.15.
    ASP.NET Core 3.0 prior to 3.0.1.
    ASP.NET Core 3.1 prior to 3.1.1.

    QID Detection Logic (Authenticated):
    This QID checks for the vulnerable version of Microsoft.AspNetCore.App and Microsoft.AspNetCore.All

    Consequence
    An attacker who successfully exploited this vulnerability could install programs;,view, change, or delete data; or create new accounts with full user rights.
    Solution
    Microsoft has released an update. Please refer to vendor security advisory CVE-2020-0603 and CVE-2020-0602 for more information.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2020-0602
    CVE-2020-0603

  • Microsoft .NET Core Security Update January 2020

    Severity
    Critical 4
    Qualys ID
    91600
    Vendor Reference
    CVE-2020-0605, CVE-2020-0606
    CVE Reference
    CVE-2020-0605, CVE-2020-0606
    CVSS Scores
    Base 9.3 / Temporal 6.9
    Description
    .NET Core is a general purpose development platform maintained by Microsoft and the .NET community on GitHub. It is cross-platform, supporting Windows, macOS and Linux, and can be used in device, cloud, and embedded/IoT scenarios.

    A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.

    Affected versions
    .NET Core 3.0 prior to 3.0.2
    .NET Core 3.1 prior to 3.1.1

    Qid detection logic:Authenticated
    The qid checks for vulnerable dotnet.dll versions on windows and checks for vulnerable .net core versions.

    Consequence
    An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
    Solution
    Microsoft has released an update. Please refer to vendor security advisory .NET Core CVE-2020-0605 and .NET Core CVE-2020-0606 for more information.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2020-0605
    CVE-2020-0606

These new vulnerability checks are included in Qualys vulnerability signature 2.4.791-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.

Selective Scan Instructions Using Qualys

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 100399
    • 110343
    • 91595
    • 91596
    • 91597
    • 91598
    • 91599
    • 91600
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.