Microsoft security alert.
June 9, 2020
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 124 vulnerabilities that were fixed in 9 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 9 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Windows Adobe Flash Player Security Update for June 2020 (ADV200010)
- Severity
- Critical 4
- Qualys ID
- 100406
- Vendor Reference
- ADV200010
- CVE Reference
- CVE-2020-9633
- CVSS Scores
- Base 10 / Temporal 7.4
- Description
-
The update contains security fixes for Adobe Flash Player on Internet Explorer.
Affected Versions:
Windows 10, version 2004,Windows 10, version 1903 and 1909,Windows 10, version 1809 and Windows Server 2019,Windows 10, version 1803,Windows 10, version 1709,Windows 10, version 1703,Windows 10, version 1607 and Windows Server 2016,Windows 10 (initial version released July 2015),Windows 8.1, Windows RT 8.1 and Windows Server 2012 R2,Windows Server 2012 with Adobe Flash Player version prior to N/A.QID Detection Logic:
This authenticated QID will flag if file version of %windir%\System32\Macromed\Flash\Flash.ocx is less than 32.0.0.387. - Consequence
-
An attacker could exploit this vulnerability to compromise Confidentiality, Integrity and/or Availability.
- Solution
-
Customers are advised to follow 4561600 for instructions pertaining to the remediation of this vulnerability.
Workaround:
1. Prevent Adobe Flash Player from running You can disable attempts to instantiate Adobe Flash Player in Internet Explorer and other applications that honor the kill bit feature, such as Office 2007 and Office 2010, by setting the kill bit for the control in the registry.
2. Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"Compatibility Flags"=dword:000004003. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"Compatibility Flags"=dword:00000400
Double-click the .reg file to apply it to an individual system.
You can also apply this workaround across domains by using Group Policy. For more information about Group Policy, see the TechNet article, Group Policy collection.Patches:
The following are links for downloading patches to fix these vulnerabilities:
ADV200010
-
Microsoft Internet Explorer Security Update for June 2020
- Severity
- Critical 4
- Qualys ID
- 100407
- Vendor Reference
- KB4557957, KB4560960, KB4561602, KB4561603, KB4561608, KB4561612, KB4561616, KB4561621, KB4561643, KB4561649, KB4561666, KB4561670
- CVE Reference
- CVE-2020-1213, CVE-2020-1214, CVE-2020-1215, CVE-2020-1216, CVE-2020-1219, CVE-2020-1230, CVE-2020-1260, CVE-2020-1315
- CVSS Scores
- Base 7.6 / Temporal 6.3
- Description
-
Microsoft releases the security update for Internet Explorer June 2020
The KB Articles associated with the update:
KB4561602
KB4561643
KB4557957
KB4560960
KB4561649
KB4561608
KB4561612
KB4561666
KB4561603
KB4561670
KB4561621
KB4561616
This QID checks for the file version of Mshtml.dll
The following versions of Mshtml.dll with their corresponding KBs are verified:
KB4561602 - 11.0.16299.1932
KB4561643 - 11.0.9600.19724
KB4557957 - 11.0.19041.329
KB4560960 - 11.0.18362.900
KB4561649 - 11.0.10240.18608
KB4561608 - 11.0.17763.1282
KB4561612 - 10.0.9200.22975 , 11.0.9600.19724
KB4561666 - 11.0.9600.19724
KB4561603 - 11.0.9600.19724 , 9.0.8112.21452
KB4561670 - 9.0.8112.21452
KB4561621 - 11.0.17134.1550
KB4561616 - 11.0.14393.3750
- Consequence
- An attacker who successfully exploited the vulnerability could gain the same user rights as the current user.
- Solution
-
Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Security Update Guide Windows
-
Microsoft SharePoint Foundation and SharePoint Server Update June 2020
- Severity
- Critical 4
- Qualys ID
- 110351
- Vendor Reference
- KB4484391, KB4484400, KB4484402, KB4484405, KB4484409, KB4484414
- CVE Reference
- CVE-2020-1148, CVE-2020-1177, CVE-2020-1178, CVE-2020-1181, CVE-2020-1183, CVE-2020-1289, CVE-2020-1295, CVE-2020-1297, CVE-2020-1298, CVE-2020-1318, CVE-2020-1320, CVE-2020-1323
- CVSS Scores
- Base 6.5 / Temporal 5.1
- Description
-
Microsoft has released June 2020 security updates to fix multiple security vulnerabilities.
This security update contains the following KBs:
KB4484402
KB4484405
KB4484414
KB4484400
KB4484391
KB4484409QID Detection Logic:
This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system. - Consequence
-
Successful exploitation allows an attacker to execute code remotely.
- Solution
-
Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft SharePoint Foundation and SharePoint Server June 2020
-
Microsoft Office and Microsoft Office Services and Web Apps Security Update June 2020
- Severity
- Critical 4
- Qualys ID
- 110352
- Vendor Reference
- KB4484342, KB4484351, KB4484361, KB4484369, KB4484373, KB4484378, KB4484380, KB4484387, KB4484396, KB4484399, KB4484403, KB4484410, KB4484415
- CVE Reference
- CVE-2020-1225, CVE-2020-1226, CVE-2020-1229, CVE-2020-1321, CVE-2020-1322
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Microsoft has released June 2020 security updates to fix multiple security vulnerabilities.
This security update contains the following KBs:
KB4484403
KB4484415
KB4484410
KB4484342
KB4484396
KB4484373
KB4484378
KB4484351
KB4484380
KB4484361
KB4484369
KB4484399
KB4484387QID Detection Logic:
This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system. - Consequence
-
Successful exploitation allows an attacker to execute code remotely.
- Solution
-
Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Office and Microsoft Office Services and Web Apps Security Update JUNE 2020
-
Microsoft Windows Servicing Stack Security Update June 2020
- Severity
- Serious 3
- Qualys ID
- 91643
- Vendor Reference
- ADV990001
- CVE Reference
- N/A
- CVSS Scores
- Base 6.8 / Temporal 5
- Description
-
Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes.
Microsoft has released Servicing Stack security updates for Windows 2008, Windows 7, Windows 2008 R2.
QID Detection Logic (Authenticated):
This authenticated QID will check for file version of CbsCore.dll - Consequence
-
Successful exploitation may allow unauthorized disclosure of information, unauthorized modification or disruption of service.
- Solution
-
Customers are advised to refer to advisory ADV990001 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
ADV990001
-
Microsoft Edge Security Update for June 2020
- Severity
- Critical 4
- Qualys ID
- 91645
- Vendor Reference
- ,CVE-2020-1195, ,CVE-2020-1219, CVE-2020-1073, CVE-2020-1242
- CVE Reference
- CVE-2020-1073, CVE-2020-1195, CVE-2020-1219, CVE-2020-1220, CVE-2020-1242
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft releases the security update for Microsoft Edge June 2020
The KB Articles associated with the update:
KB4557957
KB4560960
KB4561602
KB4561608
KB4561616
KB4561621
KB4561649
QID Detection Logic:Authenticated
This QID checks for the file version of edgehtml.dll - Consequence
- On successfull exploitation,an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Solution
-
Please refer to the CVE-2020-1242 for more information pertaining to these vulnerabilities.
Please refer to the CVE-2020-1073 for more information pertaining to these vulnerabilities.
Please refer to the CVE-2020-1195 for more information pertaining to these vulnerabilities.
Please refer to the CVE-2020-1219 for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2020-1073
CVE-2020-1195
CVE-2020-1219
CVE-2020-1242
-
Microsoft Windows Security Update for June 2020
- Severity
- Urgent 5
- Qualys ID
- 91646
- Vendor Reference
- KB4560960, KB4561602, KB4561608, KB4561612, KB4561616, KB4561621, KB4561643, KB4561645, KB4561649, KB4561666, KB4561669, KB4561670, KB4561673, KB4561674
- CVE Reference
- CVE-2020-0915, CVE-2020-0916, CVE-2020-0986, CVE-2020-1120, CVE-2020-1160, CVE-2020-1162, CVE-2020-1194, CVE-2020-1196, CVE-2020-1197, CVE-2020-1199, CVE-2020-1201, CVE-2020-1202, CVE-2020-1203, CVE-2020-1204, CVE-2020-1207, CVE-2020-1208, CVE-2020-1209, CVE-2020-1211, CVE-2020-1212, CVE-2020-1213, CVE-2020-1214, CVE-2020-1215, CVE-2020-1216, CVE-2020-1217, CVE-2020-1222, CVE-2020-1230, CVE-2020-1231, CVE-2020-1232, CVE-2020-1233, CVE-2020-1234, CVE-2020-1235, CVE-2020-1236, CVE-2020-1237, CVE-2020-1238, CVE-2020-1239, CVE-2020-1241, CVE-2020-1244, CVE-2020-1246, CVE-2020-1247, CVE-2020-1248, CVE-2020-1251, CVE-2020-1253, CVE-2020-1254, CVE-2020-1255, CVE-2020-1257, CVE-2020-1258, CVE-2020-1259, CVE-2020-1260, CVE-2020-1261, CVE-2020-1262, CVE-2020-1263, CVE-2020-1264, CVE-2020-1265, CVE-2020-1266, CVE-2020-1268, CVE-2020-1269, CVE-2020-1270, CVE-2020-1271, CVE-2020-1272, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1277, CVE-2020-1278, CVE-2020-1279, CVE-2020-1280, CVE-2020-1281, CVE-2020-1282, CVE-2020-1283, CVE-2020-1286, CVE-2020-1287, CVE-2020-1290, CVE-2020-1291, CVE-2020-1292, CVE-2020-1293, CVE-2020-1294, CVE-2020-1296, CVE-2020-1299, CVE-2020-1300, CVE-2020-1301, CVE-2020-1302, CVE-2020-1304, CVE-2020-1305, CVE-2020-1306, CVE-2020-1307, CVE-2020-1309, CVE-2020-1310, CVE-2020-1311, CVE-2020-1312, CVE-2020-1313, CVE-2020-1314, CVE-2020-1315, CVE-2020-1316, CVE-2020-1317, CVE-2020-1324, CVE-2020-1334, CVE-2020-1348, CVE-2020-1441
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft releases the security update for Windows June 2020
The KB Articles associated with the update:
KB4561602
KB4561670
KB4561674
KB4561643
KB4561645
KB4560960
KB4561673
KB4561608
KB4561612
KB4561666
KB4561669
KB4561649
KB4561621
KB4561616
This QID checks for the file version of ntoskrnl.exe
The following versions of ntoskrnl.exe with their corresponding KBs are verified:
KB4561602 - 10.0.16299.1932
KB4561670 - 6.0.6003.20851
KB4561674 - 6.2.9200.23060
KB4561643 - 6.1.7601.24556
KB4561645 - 6.0.6003.20851
KB4560960 - 10.0.18362.900
KB4561673 - 6.3.9600.19724
KB4561608 - 10.0.17763.1282
KB4561612 - 6.2.9200.23060
KB4561666 - 6.3.9600.19724
KB4561669 - 6.1.7601.24556
KB4561649 - 10.0.10240.18608
KB4561621 - 10.0.17134.1550
KB4561616 - 10.0.14393.3750
- Consequence
- An attacker could exploit the vulnerability to execute malicious code.
- Solution
-
Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Security Update Guide Windows
-
Microsoft Visual Studio Security Update for June 2020
- Severity
- Critical 4
- Qualys ID
- 91647
- Vendor Reference
- CVE-2020-1202, CVE-2020-1203, CVE-2020-1257, CVE-2020-1278, CVE-2020-1293
- CVE Reference
- CVE-2020-1202, CVE-2020-1203, CVE-2020-1257, CVE-2020-1278, CVE-2020-1293
- CVSS Scores
- Base 7.2 / Temporal 5.3
- Description
-
Microsoft has released security update for Visual Studio which resolves multiple security vulnerabilities.
Affected Software:
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
Microsoft Visual Studio 2019 version 16.6 (includes 16.0 - 16.5)
Microsoft Visual Studio 2019 version 16.0
Microsoft Visual Studio 2015 Update 3QID Detection Logic:Authenticated
This QID detects vulnerable versions of Microsoft Visual Studio by checking file version of devenv.exe. - Consequence
- Successful exploitation can affect confidentiality, integrity and availability.
- Solution
-
Customers are advised to refer to Advisory for more information pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2020-1202
CVE-2020-1203
CVE-2020-1257
CVE-2020-1278
CVE-2020-1293
-
Microsoft Windows SMBv3 Client/Server Information Disclosure Vulnerability (SMBleed)
- Severity
- Critical 4
- Qualys ID
- 91651
- Vendor Reference
- CVE-2020-1206
- CVE Reference
- CVE-2020-1206, CVE-2020-1284
- CVSS Scores
- Base 5 / Temporal 4.1
- Description
-
Microsoft Windows is exposed to an information disclosure vulnerability. The vulnerability is in Microsoft Server Message Block 3.1.1 (SMBv3) protocol handling.
Affected Software:
Windows 10 Version 1903, Windows 10 Version 1909, Windows 10 Version 2004 and Windows Server, version 1903/1909/2004 (Server Core installation)QID Detection Logic (Authenticated):
For SMB client side, this QID checks file version of "mrxsmb.sys"
For SMB Server side, this QID checks if SMB and SMB Compression are enabled as well as file version of "srvnet.sys".
Note: the file "srv2.sys" is not updated by the patch during our observation , this is why we are checking "srvnet.sys".
- Consequence
- An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system.
- Solution
-
Users are advised to check CVE-2020-1206 for more information.
Workaround:
Disable SMBv3 compression You can disable compression to block unauthenticated attackers from exploiting the vulnerability against an SMBv3 Server with the PowerShell command below.Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2020-1206 Windows(SMBv3)
These new vulnerability checks are included in Qualys vulnerability signature 2.4.911-4. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 100406
- 100407
- 110351
- 110352
- 91643
- 91645
- 91646
- 91647
- 91651
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.