Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 110 vulnerabilities that were fixed in 12 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 12 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Internet Explorer Security Update for May 2020

  Severity

  Critical 4

  Qualys ID

  100405

  Vendor Reference

  KB4551853, KB4556798, KB4556799, KB4556807, KB4556812, KB4556813, KB4556826, KB4556836, KB4556840, KB4556846, KB4556860

  CVE Reference

  CVE-2020-1035, CVE-2020-1058, CVE-2020-1060, CVE-2020-1062, CVE-2020-1064, CVE-2020-1092, CVE-2020-1093

  CVSS Scores

  Base 7.6 / Temporal 5.6

  Description

  Microsoft releases the security update for Internet Explorer May 2020

  The KB Articles associated with the update:
  KB4556846
  KB4556812
  KB4556840
  KB4556836
  KB4556826
  KB4556807
  KB4556813
  KB4556799
  KB4556798
  KB4556860
  KB4551853
  

  QID Detection Logic:
  

  This QID checks for the file version of Mshtml.dll

  The following versions of Mshtml.dll with their corresponding KBs are verified:
  KB4556846 - 11.0.9600.19699
  KB4556812 - 11.0.16299.1868
  KB4556840 - 10.0.9200.22975 , 11.0.9600.19699
  KB4556836 - 11.0.9600.19699
  KB4556826 - 11.0.10240.18575
  KB4556807 - 11.0.17134.1488
  KB4556813 - 11.0.14393.3686
  KB4556799 - 11.0.18362.836
  KB4556798 - 9.0.8112.21442 , 11.0.9600.19699
  KB4556860 - 9.0.8112.21442
  KB4551853 - 11.0.17763.1217
  

  Consequence

  The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

  Solution

  Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Update Guide Windows

• Microsoft SharePoint Foundation and SharePoint Server Update May 2020

  Severity

  Critical 4

  Qualys ID

  110349

  Vendor Reference

  KB4484332, KB4484336, KB4484352, KB4484364, KB4484383

  CVE Reference

  CVE-2020-1023, CVE-2020-1024, CVE-2020-1069, CVE-2020-1099, CVE-2020-1100, CVE-2020-1101, CVE-2020-1102, CVE-2020-1103, CVE-2020-1104, CVE-2020-1105, CVE-2020-1106, CVE-2020-1107

  CVSS Scores

  Base 6.5 / Temporal 5.1

  Description

  Microsoft has released May 2020 security updates to fix multiple security vulnerabilities.

  This security update contains the following KBs:
  KB4484336
  KB4484332
  KB4484364
  KB4484352
  KB4484383

  QID Detection Logic:
  This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.

  Consequence

  Successful exploitation allows an attacker to execute code remotely.

  Solution

  Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft SharePoint Foundation and SharePoint Server May 2020

• Microsoft Office and Microsoft Office Services and Web Apps Security Update May 2020

  Severity

  Critical 4

  Qualys ID

  110350

  Vendor Reference

  KB4484338, KB4484365, KB4484384

  CVE Reference

  CVE-2020-0901

  CVSS Scores

  Base 7.5 / Temporal 5.5

  Description

  Microsoft has released May 2020 security updates to fix multiple security vulnerabilities.

  This security update contains the following KBs:
  KB4484338
  KB4484384
  KB4484365

  QID Detection Logic:
  This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.

  Consequence

  Successful exploitation allows an attacker to execute code remotely.

  Solution

  Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Office and Microsoft Office Services and Web Apps Security Update May 2020

• Microsoft Windows Servicing Stack Security Update May 2020

  Severity

  Serious 3

  Qualys ID

  91632

  Vendor Reference

  ADV990001

  CVE Reference

  N/A

  CVSS Scores

  Base 6.8 / Temporal 5

  Description

  Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes.

  Microsoft has released Servicing Stack security updates for Windows 2008, Windows 7, Windows 2008 R2.

  QID Detection Logic (Authenticated):
  This authenticated QID will check for file version of CbsCore.dll

  Consequence

  Successful exploitation may allow unauthorized disclosure of information, unauthorized modification or disruption of service.

  Solution

  Customers are advised to refer to advisory ADV990001 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  ADV990001

• Microsoft Dynamics 365 Security Update for May 2020

  Severity

  Serious 3

  Qualys ID

  91633

  Vendor Reference

  CVE-2020-1063, CVE-2020-1328

  CVE Reference

  CVE-2020-1063, CVE-2020-1328

  CVSS Scores

  Base 3.5 / Temporal 2.6

  Description

  Multiple cross site scripting vulnerabilities exist when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server.

  The security update addresses the vulnerability by helping to ensure that Dynamics Server properly sanitizes web requests.

  Affected Versions:
  Microsoft Dynamics 365 (on-premises) version 8.2
  Microsoft Dynamics 365 (on-premises) version 9.0

  KB Articles: KB4551998, KB4552002

  QID Detection Logic:
  This authenticated QID flags vulnerable systems by detecting Microsoft.Crm.Setup.Server.exe versions lesser than:
  Microsoft Dynamics 365 (on-premises) version 8.2: 8.2.18.16
  Microsoft Dynamics 365 (on-premises) version 9.0: 9.0.16.7

  Consequence

  Successful exploitation allows an authenticated, remote attacker to perform cross-site scripting attacks on affected systems and run script in the security context of the current authenticated user.

  Solution

  Customers are advised to refer to CVE-2020-1063 for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-1063

• Microsoft .NET Framework Security Updates for May 2020

  Severity

  Critical 4

  Qualys ID

  91634

  Vendor Reference

  KB4552926, KB4552928, KB4552929, KB4552931, KB4556399, KB4556400, KB4556401, KB4556402, KB4556403, KB4556404, KB4556405, KB4556406, KB4556441, KB4556807, KB4556812, KB4556826

  CVE Reference

  CVE-2020-1066, CVE-2020-1108

  CVSS Scores

  Base 5 / Temporal 4.1

  Description

  A denial of service vulnerability exists when .NET Framework improperly handles web requests.
  An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level.

  KB4552926,KB4552928,KB4552929,KB4552931,KB4556399,KB4556400,KB4556401,KB4556402,KB4556403,KB4556404,KB4556405,KB4556406,KB4556441,KB4556807,KB4556812,KB4556826 kbs are covered.
  This security update is rated Important for supported versions of Microsoft .NET Framework.

  QID Detection Logic (Authenticated):
  - Checks for vulnerable version of Mscorlib.dll file
  

  Consequence

  Successful exploitation allows attacker to elevate their privilege level and also cause a denial of service.

  Solution

  Customers are advised to refer to CVE-2020-1066, CVE-2020-1108 for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-1066
  CVE-2020-1108

• Microsoft Power BI Report Server Security Update for May 2020

  Severity

  Serious 3

  Qualys ID

  91635

  Vendor Reference

  CVE-2020-1173

  CVE Reference

  CVE-2020-1173

  CVSS Scores

  Base 3.5 / Temporal 2.6

  Description

  A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An authenticated attacker could exploit the vulnerability by uploading a specially crafted payload and sending it to the user.

  This security update addresses the vulnerability by ensuring Power BI Report Server properly validates content-type of the attachments when uploading and opening.

  Affected Versions:
  Power BI Report Server versions prior to 15.0.1102.646

  QID Detection Logic:
  This authenticated QID detects vulnerable versions of RSHostingService.exe by fetching the service installed path from the HKLM\SYSTEM\CurrentControlSet\Services\PowerBIReportServer registry key.

  NOTE:According to the advisory, Microsoft mentions that the most recent version of Power BI is the January 2020 release build is 15.0.1102.777. However, this vulnerability was addressed in the September 2019 release, version 1.6.7236.4246 (Build 15.0.1102.646).

  Consequence

  Successful exploitation allows an attacker to perform actions and run scripts in the security context of the user.

  Solution

  Customers are advised to refer to CVE-2020-1173 for more information pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-1173

• Microsoft Windows Security Update for May 2020

  Severity

  Critical 4

  Qualys ID

  91636

  Vendor Reference

  KB4551853, KB4556799, KB4556807, KB4556812, KB4556813, KB4556826, KB4556836, KB4556840, KB4556843, KB4556846, KB4556852, KB4556853, KB4556854, KB4556860

  CVE Reference

  CVE-2020-0909, CVE-2020-0963, CVE-2020-1010, CVE-2020-1021, CVE-2020-1028, CVE-2020-1035, CVE-2020-1048, CVE-2020-1051, CVE-2020-1054, CVE-2020-1055, CVE-2020-1058, CVE-2020-1060, CVE-2020-1061, CVE-2020-1062, CVE-2020-1064, CVE-2020-1067, CVE-2020-1068, CVE-2020-1070, CVE-2020-1071, CVE-2020-1072, CVE-2020-1075, CVE-2020-1076, CVE-2020-1077, CVE-2020-1078, CVE-2020-1079, CVE-2020-1081, CVE-2020-1082, CVE-2020-1084, CVE-2020-1086, CVE-2020-1087, CVE-2020-1088, CVE-2020-1090, CVE-2020-1092, CVE-2020-1093, CVE-2020-1109, CVE-2020-1110, CVE-2020-1111, CVE-2020-1112, CVE-2020-1113, CVE-2020-1114, CVE-2020-1116, CVE-2020-1117, CVE-2020-1118, CVE-2020-1121, CVE-2020-1123, CVE-2020-1124, CVE-2020-1125, CVE-2020-1126, CVE-2020-1131, CVE-2020-1132, CVE-2020-1134, CVE-2020-1135, CVE-2020-1136, CVE-2020-1137, CVE-2020-1138, CVE-2020-1139, CVE-2020-1140, CVE-2020-1141, CVE-2020-1142, CVE-2020-1143, CVE-2020-1144, CVE-2020-1145, CVE-2020-1149, CVE-2020-1150, CVE-2020-1151, CVE-2020-1153, CVE-2020-1154, CVE-2020-1155, CVE-2020-1156, CVE-2020-1157, CVE-2020-1158, CVE-2020-1164, CVE-2020-1165, CVE-2020-1166, CVE-2020-1174, CVE-2020-1175, CVE-2020-1176, CVE-2020-1179, CVE-2020-1184, CVE-2020-1185, CVE-2020-1186, CVE-2020-1187, CVE-2020-1188, CVE-2020-1189, CVE-2020-1190, CVE-2020-1191

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft releases the security update for Windows May 2020

  The KB Articles associated with the update:
  KB4556846
  KB4556812
  KB4556854
  KB4556860
  KB4556840
  KB4556836
  KB4556826
  KB4556807
  KB4556853
  KB4556813
  KB4556799
  KB4556852
  KB4551853
  KB4556843
  

  This QID checks for the file version of ntoskrnl.exe

  The following versions of ntoskrnl.exe with their corresponding KBs are verified:
  KB4556846 - 6.3.9600.19697
  KB4556812 - 10.0.16299.1868
  KB4556854 - 6.0.6003.20825
  KB4556860 - 6.0.6003.20825
  KB4556840 - 6.2.9200.23037
  KB4556836 - 6.1.7601.24553
  KB4556826 - 10.0.10240.18575
  KB4556807 - 10.0.17134.1488
  KB4556853 - 6.3.9600.19697
  KB4556813 - 10.0.14393.3686
  KB4556799 - 10.0.18362.836
  KB4556852 - 6.2.9200.23037
  KB4551853 - 10.0.17763.1217
  KB4556843 - 6.1.7601.24553
  

  Consequence

  An attacker who successfully exploited the vulnerability could take control of the affected system.

  Solution

  Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Update Guide Windows

• Microsoft Visual Studio Security Update for May 2020

  Severity

  Critical 4

  Qualys ID

  91637

  Vendor Reference

  CVE-2020-1108, CVE-2020-1161

  CVE Reference

  CVE-2020-1108, CVE-2020-1161

  CVSS Scores

  Base 5 / Temporal 3.7

  Description

  An elevation of privilege vulnerability exists when Microsoft Visual Studio updater service improperly handles file permissions. An attacker who successfully exploited this vulnerability could overwrite arbitrary file content in the security context of the local system.

  An elevation of privilege vulnerability exists when the Visual Studio Extension Installer Service improperly handles file operations. An attacker who successfully exploited the vulnerability could delete files in arbitrary locations with elevated permissions.

  Affected Software:
  Microsoft Visual Studio 2017 Version 15.9 (includes 15.1 - 15.8)
  Microsoft Visual Studio 2019 Version 16.0
  Microsoft Visual Studio 2019 Version 16.4 (includes 16.0 - 16.3)BR> Microsoft Visual Studio 2019 version 16.5

  QID Detection Logic:Authenticated
  This QID detects vulnerable versions of Microsoft Visual Studio by checking file version of devenv.exe.

  Consequence

  Successful exploitation allows attacker to overwrite arbitrary and delete files in arbitrary locations with elevated permissions.

  Solution

  Customers are advised to refer to CVE-2020-1161 CVE-2020-1108 for more information pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-1108 Windows
  CVE-2020-1161 Windows

• Microsoft .NET Core Security Update May 2020

  Severity

  Serious 3

  Qualys ID

  91638

  Vendor Reference

  CVE-2020-1108

  CVE Reference

  CVE-2020-1108

  CVSS Scores

  Base 5 / Temporal 3.7

  Description

  A denial of service vulnerability exists when .NET Core improperly handles web requests.
  This security update is rated Important for supported versions of .NET Core.

  Affected versions:
  .NET Core 2.1.x prior to 2.1.19
  .NET Core 3.1.x prior to 3.1.5
  .NET Core 5.0.x prior to 5.0.0-Preview 4

  QID Detection Logic (Authenticated):
  The qid looks for sub directories under %programfiles%\dotnet\shared\Microsoft.NETCore.App, %programfiles(x86)%\dotnet\shared\Microsoft.NETCore.App and checks for vulnerable versions in .version file on windows.

  Consequence

  Successful exploitation allows attacker to cause denial of service.

  Solution

  Microsoft has released an update. Please refer to vendor security advisory .NET Core CVE-2020-1108 for more information.
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  .Net Core CVE-2020-1108

• Microsoft ASP.NET Core Denial of Service Vulnerability May 2020

  Severity

  Serious 3

  Qualys ID

  91639

  Vendor Reference

  CVE-2020-1161

  CVE Reference

  CVE-2020-1161

  CVSS Scores

  Base 5 / Temporal 3.7

  Description

  A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication.

  This security update is rated Important for supported versions of Microsoft .NET Framework.

  Affected versions:
  .NET Core 3.1.x prior to 3.1.4

  QID Detection Logic (Authenticated):
  The qid looks for sub directories under %programfiles%\dotnet\shared\Microsoft.NETCore.App, %programfiles(x86)%\dotnet\shared\Microsoft.NETCore.App and checks for vulnerable versions in .version file on windows.

  Consequence

  Successful exploitation allows attacker to cause denial of service.

  Solution

  Customers are advised to refer to CVE-2020-1161 for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  ASP.NET Core CVE-2020-1161

• Microsoft Edge Security Update for May 2020

  Severity

  Critical 4

  Qualys ID

  91640

  Vendor Reference

  ,CVE-2020-1056, ,CVE-2020-1059, ,CVE-2020-1065, ,CVE-2020-1096, CVE-2020-1037

  CVE Reference

  CVE-2020-1037, CVE-2020-1056, CVE-2020-1059, CVE-2020-1065, CVE-2020-1096

  CVSS Scores

  Base 7.6 / Temporal 5.6

  Description

  Microsoft releases the security update for Microsoft Edge May 2020

  The KB Articles associated with the update:
  KB4551853
  KB4556799
  KB4556807
  KB4556812
  KB4556813
  KB4556826
  

  QID Detection Logic:Authenticated
  This QID checks for the file version of edgehtml.dll

  Consequence

  On successfull exploitation,an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Please refer to the CVE-2020-1037 for more information pertaining to these vulnerabilities.

  Please refer to the CVE-2020-1056 for more information pertaining to these vulnerabilities.

  Please refer to the CVE-2020-1059 for more information pertaining to these vulnerabilities.

  Please refer to the CVE-2020-1065 for more information pertaining to these vulnerabilities.

  Please refer to the CVE-2020-1096 for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-1037
  CVE-2020-1056
  CVE-2020-1059
  CVE-2020-1065
  CVE-2020-1096

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.