Microsoft security alert.
May 12, 2020
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 110 vulnerabilities that were fixed in 12 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 12 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Internet Explorer Security Update for May 2020
- Severity
- Critical 4
- Qualys ID
- 100405
- Vendor Reference
- KB4551853, KB4556798, KB4556799, KB4556807, KB4556812, KB4556813, KB4556826, KB4556836, KB4556840, KB4556846, KB4556860
- CVE Reference
- CVE-2020-1035, CVE-2020-1058, CVE-2020-1060, CVE-2020-1062, CVE-2020-1064, CVE-2020-1092, CVE-2020-1093
- CVSS Scores
- Base 7.6 / Temporal 5.6
- Description
-
Microsoft releases the security update for Internet Explorer May 2020
The KB Articles associated with the update:
KB4556846
KB4556812
KB4556840
KB4556836
KB4556826
KB4556807
KB4556813
KB4556799
KB4556798
KB4556860
KB4551853
QID Detection Logic:
This QID checks for the file version of Mshtml.dll
The following versions of Mshtml.dll with their corresponding KBs are verified:
KB4556846 - 11.0.9600.19699
KB4556812 - 11.0.16299.1868
KB4556840 - 10.0.9200.22975 , 11.0.9600.19699
KB4556836 - 11.0.9600.19699
KB4556826 - 11.0.10240.18575
KB4556807 - 11.0.17134.1488
KB4556813 - 11.0.14393.3686
KB4556799 - 11.0.18362.836
KB4556798 - 9.0.8112.21442 , 11.0.9600.19699
KB4556860 - 9.0.8112.21442
KB4551853 - 11.0.17763.1217
- Consequence
- The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
- Solution
-
Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Security Update Guide Windows
-
Microsoft SharePoint Foundation and SharePoint Server Update May 2020
- Severity
- Critical 4
- Qualys ID
- 110349
- Vendor Reference
- KB4484332, KB4484336, KB4484352, KB4484364, KB4484383
- CVE Reference
- CVE-2020-1023, CVE-2020-1024, CVE-2020-1069, CVE-2020-1099, CVE-2020-1100, CVE-2020-1101, CVE-2020-1102, CVE-2020-1103, CVE-2020-1104, CVE-2020-1105, CVE-2020-1106, CVE-2020-1107
- CVSS Scores
- Base 6.5 / Temporal 5.1
- Description
-
Microsoft has released May 2020 security updates to fix multiple security vulnerabilities.
This security update contains the following KBs:
KB4484336
KB4484332
KB4484364
KB4484352
KB4484383QID Detection Logic:
This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system. - Consequence
-
Successful exploitation allows an attacker to execute code remotely.
- Solution
-
Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft SharePoint Foundation and SharePoint Server May 2020
-
Microsoft Office and Microsoft Office Services and Web Apps Security Update May 2020
- Severity
- Critical 4
- Qualys ID
- 110350
- Vendor Reference
- KB4484338, KB4484365, KB4484384
- CVE Reference
- CVE-2020-0901
- CVSS Scores
- Base 7.5 / Temporal 5.5
- Description
-
Microsoft has released May 2020 security updates to fix multiple security vulnerabilities.
This security update contains the following KBs:
KB4484338
KB4484384
KB4484365QID Detection Logic:
This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system. - Consequence
-
Successful exploitation allows an attacker to execute code remotely.
- Solution
-
Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Office and Microsoft Office Services and Web Apps Security Update May 2020
-
Microsoft Windows Servicing Stack Security Update May 2020
- Severity
- Serious 3
- Qualys ID
- 91632
- Vendor Reference
- ADV990001
- CVE Reference
- N/A
- CVSS Scores
- Base 6.8 / Temporal 5
- Description
-
Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes.
Microsoft has released Servicing Stack security updates for Windows 2008, Windows 7, Windows 2008 R2.
QID Detection Logic (Authenticated):
This authenticated QID will check for file version of CbsCore.dll - Consequence
-
Successful exploitation may allow unauthorized disclosure of information, unauthorized modification or disruption of service.
- Solution
-
Customers are advised to refer to advisory ADV990001 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
ADV990001
-
Microsoft Dynamics 365 Security Update for May 2020
- Severity
- Serious 3
- Qualys ID
- 91633
- Vendor Reference
- CVE-2020-1063, CVE-2020-1328
- CVE Reference
- CVE-2020-1063, CVE-2020-1328
- CVSS Scores
- Base 3.5 / Temporal 2.6
- Description
-
Multiple cross site scripting vulnerabilities exist when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server.
The security update addresses the vulnerability by helping to ensure that Dynamics Server properly sanitizes web requests.
Affected Versions:
Microsoft Dynamics 365 (on-premises) version 8.2
Microsoft Dynamics 365 (on-premises) version 9.0KB Articles: KB4551998, KB4552002
QID Detection Logic:
This authenticated QID flags vulnerable systems by detecting Microsoft.Crm.Setup.Server.exe versions lesser than:
Microsoft Dynamics 365 (on-premises) version 8.2: 8.2.18.16
Microsoft Dynamics 365 (on-premises) version 9.0: 9.0.16.7 - Consequence
-
Successful exploitation allows an authenticated, remote attacker to perform cross-site scripting attacks on affected systems and run script in the security context of the current authenticated user.
- Solution
-
Customers are advised to refer to CVE-2020-1063 for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2020-1063
-
Microsoft .NET Framework Security Updates for May 2020
- Severity
- Critical 4
- Qualys ID
- 91634
- Vendor Reference
- KB4552926, KB4552928, KB4552929, KB4552931, KB4556399, KB4556400, KB4556401, KB4556402, KB4556403, KB4556404, KB4556405, KB4556406, KB4556441, KB4556807, KB4556812, KB4556826
- CVE Reference
- CVE-2020-1066, CVE-2020-1108
- CVSS Scores
- Base 5 / Temporal 4.1
- Description
-
A denial of service vulnerability exists when .NET Framework improperly handles web requests.
An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level.KB4552926,KB4552928,KB4552929,KB4552931,KB4556399,KB4556400,KB4556401,KB4556402,KB4556403,KB4556404,KB4556405,KB4556406,KB4556441,KB4556807,KB4556812,KB4556826 kbs are covered.
This security update is rated Important for supported versions of Microsoft .NET Framework.QID Detection Logic (Authenticated):
- Checks for vulnerable version of Mscorlib.dll file
- Consequence
- Successful exploitation allows attacker to elevate their privilege level and also cause a denial of service.
- Solution
-
Customers are advised to refer to CVE-2020-1066, CVE-2020-1108 for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2020-1066
CVE-2020-1108
-
Microsoft Power BI Report Server Security Update for May 2020
- Severity
- Serious 3
- Qualys ID
- 91635
- Vendor Reference
- CVE-2020-1173
- CVE Reference
- CVE-2020-1173
- CVSS Scores
- Base 3.5 / Temporal 2.6
- Description
-
A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An authenticated attacker could exploit the vulnerability by uploading a specially crafted payload and sending it to the user.
This security update addresses the vulnerability by ensuring Power BI Report Server properly validates content-type of the attachments when uploading and opening.
Affected Versions:
Power BI Report Server versions prior to 15.0.1102.646QID Detection Logic:
This authenticated QID detects vulnerable versions of RSHostingService.exe by fetching the service installed path from the HKLM\SYSTEM\CurrentControlSet\Services\PowerBIReportServer registry key.NOTE:According to the advisory, Microsoft mentions that the most recent version of Power BI is the January 2020 release build is 15.0.1102.777. However, this vulnerability was addressed in the September 2019 release, version 1.6.7236.4246 (Build 15.0.1102.646).
- Consequence
-
Successful exploitation allows an attacker to perform actions and run scripts in the security context of the user.
- Solution
-
Customers are advised to refer to CVE-2020-1173 for more information pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2020-1173
-
Microsoft Windows Security Update for May 2020
- Severity
- Critical 4
- Qualys ID
- 91636
- Vendor Reference
- KB4551853, KB4556799, KB4556807, KB4556812, KB4556813, KB4556826, KB4556836, KB4556840, KB4556843, KB4556846, KB4556852, KB4556853, KB4556854, KB4556860
- CVE Reference
- CVE-2020-0909, CVE-2020-0963, CVE-2020-1010, CVE-2020-1021, CVE-2020-1028, CVE-2020-1035, CVE-2020-1048, CVE-2020-1051, CVE-2020-1054, CVE-2020-1055, CVE-2020-1058, CVE-2020-1060, CVE-2020-1061, CVE-2020-1062, CVE-2020-1064, CVE-2020-1067, CVE-2020-1068, CVE-2020-1070, CVE-2020-1071, CVE-2020-1072, CVE-2020-1075, CVE-2020-1076, CVE-2020-1077, CVE-2020-1078, CVE-2020-1079, CVE-2020-1081, CVE-2020-1082, CVE-2020-1084, CVE-2020-1086, CVE-2020-1087, CVE-2020-1088, CVE-2020-1090, CVE-2020-1092, CVE-2020-1093, CVE-2020-1109, CVE-2020-1110, CVE-2020-1111, CVE-2020-1112, CVE-2020-1113, CVE-2020-1114, CVE-2020-1116, CVE-2020-1117, CVE-2020-1118, CVE-2020-1121, CVE-2020-1123, CVE-2020-1124, CVE-2020-1125, CVE-2020-1126, CVE-2020-1131, CVE-2020-1132, CVE-2020-1134, CVE-2020-1135, CVE-2020-1136, CVE-2020-1137, CVE-2020-1138, CVE-2020-1139, CVE-2020-1140, CVE-2020-1141, CVE-2020-1142, CVE-2020-1143, CVE-2020-1144, CVE-2020-1145, CVE-2020-1149, CVE-2020-1150, CVE-2020-1151, CVE-2020-1153, CVE-2020-1154, CVE-2020-1155, CVE-2020-1156, CVE-2020-1157, CVE-2020-1158, CVE-2020-1164, CVE-2020-1165, CVE-2020-1166, CVE-2020-1174, CVE-2020-1175, CVE-2020-1176, CVE-2020-1179, CVE-2020-1184, CVE-2020-1185, CVE-2020-1186, CVE-2020-1187, CVE-2020-1188, CVE-2020-1189, CVE-2020-1190, CVE-2020-1191
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft releases the security update for Windows May 2020
The KB Articles associated with the update:
KB4556846
KB4556812
KB4556854
KB4556860
KB4556840
KB4556836
KB4556826
KB4556807
KB4556853
KB4556813
KB4556799
KB4556852
KB4551853
KB4556843
This QID checks for the file version of ntoskrnl.exe
The following versions of ntoskrnl.exe with their corresponding KBs are verified:
KB4556846 - 6.3.9600.19697
KB4556812 - 10.0.16299.1868
KB4556854 - 6.0.6003.20825
KB4556860 - 6.0.6003.20825
KB4556840 - 6.2.9200.23037
KB4556836 - 6.1.7601.24553
KB4556826 - 10.0.10240.18575
KB4556807 - 10.0.17134.1488
KB4556853 - 6.3.9600.19697
KB4556813 - 10.0.14393.3686
KB4556799 - 10.0.18362.836
KB4556852 - 6.2.9200.23037
KB4551853 - 10.0.17763.1217
KB4556843 - 6.1.7601.24553
- Consequence
- An attacker who successfully exploited the vulnerability could take control of the affected system.
- Solution
-
Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Security Update Guide Windows
-
Microsoft Visual Studio Security Update for May 2020
- Severity
- Critical 4
- Qualys ID
- 91637
- Vendor Reference
- CVE-2020-1108, CVE-2020-1161
- CVE Reference
- CVE-2020-1108, CVE-2020-1161
- CVSS Scores
- Base 5 / Temporal 3.7
- Description
-
An elevation of privilege vulnerability exists when Microsoft Visual Studio updater service improperly handles file permissions. An attacker who successfully exploited this vulnerability could overwrite arbitrary file content in the security context of the local system.
An elevation of privilege vulnerability exists when the Visual Studio Extension Installer Service improperly handles file operations. An attacker who successfully exploited the vulnerability could delete files in arbitrary locations with elevated permissions.
Affected Software:
Microsoft Visual Studio 2017 Version 15.9 (includes 15.1 - 15.8)
Microsoft Visual Studio 2019 Version 16.0
Microsoft Visual Studio 2019 Version 16.4 (includes 16.0 - 16.3)BR> Microsoft Visual Studio 2019 version 16.5QID Detection Logic:Authenticated
This QID detects vulnerable versions of Microsoft Visual Studio by checking file version of devenv.exe. - Consequence
- Successful exploitation allows attacker to overwrite arbitrary and delete files in arbitrary locations with elevated permissions.
- Solution
-
Customers are advised to refer to CVE-2020-1161 CVE-2020-1108 for more information pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2020-1108 Windows
CVE-2020-1161 Windows
-
Microsoft .NET Core Security Update May 2020
- Severity
- Serious 3
- Qualys ID
- 91638
- Vendor Reference
- CVE-2020-1108
- CVE Reference
- CVE-2020-1108
- CVSS Scores
- Base 5 / Temporal 3.7
- Description
-
A denial of service vulnerability exists when .NET Core improperly handles web requests.
This security update is rated Important for supported versions of .NET Core.Affected versions:
.NET Core 2.1.x prior to 2.1.19
.NET Core 3.1.x prior to 3.1.5
.NET Core 5.0.x prior to 5.0.0-Preview 4QID Detection Logic (Authenticated):
The qid looks for sub directories under %programfiles%\dotnet\shared\Microsoft.NETCore.App, %programfiles(x86)%\dotnet\shared\Microsoft.NETCore.App and checks for vulnerable versions in .version file on windows. - Consequence
- Successful exploitation allows attacker to cause denial of service.
- Solution
-
Microsoft has released an update. Please refer to vendor security advisory .NET Core CVE-2020-1108 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
.Net Core CVE-2020-1108
-
Microsoft ASP.NET Core Denial of Service Vulnerability May 2020
- Severity
- Serious 3
- Qualys ID
- 91639
- Vendor Reference
- CVE-2020-1161
- CVE Reference
- CVE-2020-1161
- CVSS Scores
- Base 5 / Temporal 3.7
- Description
-
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication.
This security update is rated Important for supported versions of Microsoft .NET Framework.
Affected versions:
.NET Core 3.1.x prior to 3.1.4QID Detection Logic (Authenticated):
The qid looks for sub directories under %programfiles%\dotnet\shared\Microsoft.NETCore.App, %programfiles(x86)%\dotnet\shared\Microsoft.NETCore.App and checks for vulnerable versions in .version file on windows. - Consequence
- Successful exploitation allows attacker to cause denial of service.
- Solution
-
Customers are advised to refer to CVE-2020-1161 for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
ASP.NET Core CVE-2020-1161
-
Microsoft Edge Security Update for May 2020
- Severity
- Critical 4
- Qualys ID
- 91640
- Vendor Reference
- ,CVE-2020-1056, ,CVE-2020-1059, ,CVE-2020-1065, ,CVE-2020-1096, CVE-2020-1037
- CVE Reference
- CVE-2020-1037, CVE-2020-1056, CVE-2020-1059, CVE-2020-1065, CVE-2020-1096
- CVSS Scores
- Base 7.6 / Temporal 5.6
- Description
-
Microsoft releases the security update for Microsoft Edge May 2020
The KB Articles associated with the update:
KB4551853
KB4556799
KB4556807
KB4556812
KB4556813
KB4556826
QID Detection Logic:Authenticated
This QID checks for the file version of edgehtml.dll - Consequence
- On successfull exploitation,an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Solution
-
Please refer to the CVE-2020-1037 for more information pertaining to these vulnerabilities.
Please refer to the CVE-2020-1056 for more information pertaining to these vulnerabilities.
Please refer to the CVE-2020-1059 for more information pertaining to these vulnerabilities.
Please refer to the CVE-2020-1065 for more information pertaining to these vulnerabilities.
Please refer to the CVE-2020-1096 for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2020-1037
CVE-2020-1056
CVE-2020-1059
CVE-2020-1065
CVE-2020-1096
These new vulnerability checks are included in Qualys vulnerability signature 2.4.889-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 100405
- 110349
- 110350
- 91632
- 91633
- 91634
- 91635
- 91636
- 91637
- 91638
- 91639
- 91640
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.