Microsoft security alert.
July 14, 2020
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 120 vulnerabilities that were fixed in 13 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 13 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Internet Explorer Security Update for July 2020
- Severity
- Critical 4
- Qualys ID
- 100408
- Vendor Reference
- KB4558998, KB4565479, KB4565483, KB4565489, KB4565503, KB4565508, KB4565511, KB4565513, KB4565524, KB4565536, KB4565537, KB4565541
- CVE Reference
- CVE-2020-1403, CVE-2020-1432
- CVSS Scores
- Base 7.6 / Temporal 5.6
- Description
-
Microsoft releases the security update for Internet Explorer July 2020
The KB Articles associated with the update:
KB4565479
KB4565537
KB4565513
KB4565489
KB4565508
KB4565511
KB4565503
KB4565524
KB4565483
KB4565541
KB4565536
KB4558998
This QID checks for the file version of Mshtml.dll
The following versions of Mshtml.dll with their corresponding KBs are verified:
KB4565479 - 9.0.8112.21461 , 11.0.9600.19750
KB4565537 - 11.0.9600.19750
KB4565513 - 11.0.10240.18638
KB4565489 - 11.0.17134.1610
KB4565508 - 11.0.16299.1992
KB4565511 - 11.0.14393.3808
KB4565503 - 11.0.19041.388
KB4565524 - 11.0.9600.19750
KB4565483 - 11.0.18362.959
KB4565541 - 11.0.9600.19750
KB4565536 - 9.0.8112.21461
KB4558998 - 11.0.17763.1339
- Consequence
- An attacker who successfully exploited the vulnerability could gain the same user rights as the current user.
- Solution
-
Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Security Update Guide Windows
-
Microsoft SharePoint Foundation and SharePoint Server Update July 2020
- Severity
- Urgent 5
- Qualys ID
- 110354
- Vendor Reference
- KB4484353, KB4484370, KB4484374, KB4484411, KB4484436, KB4484440, KB4484443, KB4484448, KB4484451, KB4484453
- CVE Reference
- CVE-2020-1025, CVE-2020-1147, CVE-2020-1342, CVE-2020-1439, CVE-2020-1443, CVE-2020-1444, CVE-2020-1445, CVE-2020-1446, CVE-2020-1447, CVE-2020-1448, CVE-2020-1450, CVE-2020-1451, CVE-2020-1454, CVE-2020-1456
- CVSS Scores
- Base 7.5 / Temporal 6.2
- Description
-
Microsoft has released July 2020 security updates to fix multiple security vulnerabilities.
This security update contains the following KBs:
KB4484443
KB4484453
KB4484448
KB4484451
KB4484436
KB4484370
KB4484440
KB4484374
KB4484411
KB4484353QID Detection Logic:
This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected SharePoint system. - Consequence
-
Successful exploitation allows an attacker to execute code remotely.
- Solution
-
Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft SharePoint Foundation and SharePoint Server July 2020
-
Microsoft Office and Microsoft Office Services and Web Apps Security Update July 2020
- Severity
- Critical 4
- Qualys ID
- 110355
- Vendor Reference
- KB4484357, KB4484363, KB4484381, KB4484382, KB4484433, KB4484438, KB4484441, KB4484446, KB4484450, KB4484451, KB4484456, KB4484458, KB4484463
- CVE Reference
- CVE-2020-1240, CVE-2020-1342, CVE-2020-1349, CVE-2020-1409, CVE-2020-1442, CVE-2020-1445, CVE-2020-1446, CVE-2020-1447, CVE-2020-1448, CVE-2020-1449, CVE-2020-1458
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Microsoft has released July 2020 security updates to fix multiple security vulnerabilities.
This security update contains the following KBs:
KB4484357
KB4484451
KB4484458
KB4484446
KB4484463
KB4484441
KB4484450
KB4484363
KB4484456
KB4484438
KB4484433
KB4484381
KB4484382QID Detection Logic:
This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system. - Consequence
-
Successful exploitation allows an attacker to execute code remotely.
- Solution
-
Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Office and Microsoft Office Services and Web Apps Security Update JUNE 2020
-
Microsoft Skype for Business Server Security and Lync Server Update for July 2020
- Severity
- Critical 4
- Qualys ID
- 110356
- Vendor Reference
- KB4571334
- CVE Reference
- CVE-2020-1025
- CVSS Scores
- Base 7.5 / Temporal 5.5
- Description
-
An elevation of privilege vulnerability exists when Skype for Business Server improperly handles OAuth token validation. To exploit this vulnerability, an attacker would need to modify the token.
The update addresses the vulnerability by modifying how Microsoft Skype for Business Server validate tokens.
Affected Software:
Microsoft Lync Server 2013KB articles: 4571334
QID Detection Logic:
This authenticated QID detects vulnerable Lync Server 2013 Web Component by checking Microsoft.Rtc.Server.WebInfrastructure.dll file versions lesser than 5.0.8308.1134 from:
\Microsoft.NET\assembly\GAC_32\Microsoft.Rtc.Server.WebInfrastructure.0_5.0.0.0*
\Microsoft.NET\assembly\GAC_64\Microsoft.Rtc.Server.WebInfrastructure.0_5.0.0.0*
- Consequence
-
Successful exploitation allows a remote attacker to bypass authentication and achieve improper access.
- Solution
-
Customers are advised to refer to CVE-2020-1025 for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Skype for Business Server 2015 CU8
Skype for Business Server 2019 CU2
-
Microsoft OneDrive Update for July 2020
- Severity
- Serious 3
- Qualys ID
- 110357
- Vendor Reference
- CVE-2020-1465
- CVE Reference
- CVE-2020-1465
- CVSS Scores
- Base 7.2 / Temporal 5.3
- Description
-
An elevation of privilege vulnerability exists in Microsoft OneDrive that allows file deletion in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the system.
The update addresses the vulnerability by correcting how Microsoft OneDrive handles file operations.
Affected Software:
OneDrive for Windows versions prior to 20.114.0607.0002 for all ringsQID Detection Logic:
This QID detects vulnerable versions of OneDrive by checking file version of OneDrive.exeNOTE: Only per machine installation (System wide installation) of OneDrive are affected.
- Consequence
-
An attacker could run a specially crafted application that could exploit the vulnerability and take control of an affected system.
- Solution
-
Customers are advised to refer to CVE-2020-1465 for more information pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
OneDrive for Windows
-
Microsoft KB4569509 Mitigation Guidance for DNS Server Applied (CVE-2020-1350)
- Severity
- Minimal 1
- Qualys ID
- 45451
- Vendor Reference
- N/A
- CVE Reference
- N/A
- CVSS Scores
- Base / Temporal
- Description
-
Mitigation for "CVE-2020-1350 Windows DNS Server Remote Code Execution Vulnerability" is applied on the host.
QID Detection Logic (Authenticated):
This QID checks for Windows registry key "HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters", posts this QID when value "TcpReceivePacketSize" is 65280(0xFF00)
- Consequence
- N/A
- Solution
-
Please refer to the KB4569509: Guidance for DNS Server Vulnerability CVE-2020-1350 for more information
-
Microsoft Windows Security Update for July 2020
- Severity
- Urgent 5
- Qualys ID
- 91653
- Vendor Reference
- KB4558998, KB4565483, KB4565489, KB4565503, KB4565508, KB4565511, KB4565513, KB4565524, KB4565529, KB4565535, KB4565536, KB4565537, KB4565539, KB4565540, KB4565541, KB5011570, KB5011649, KB5012672, KB5013270, KB5014026, KB5014027
- CVE Reference
- CVE-2020-1032, CVE-2020-1036, CVE-2020-1040, CVE-2020-1041, CVE-2020-1042, CVE-2020-1043, CVE-2020-1085, CVE-2020-1249, CVE-2020-1267, CVE-2020-1330, CVE-2020-1333, CVE-2020-1336, CVE-2020-1344, CVE-2020-1346, CVE-2020-1347, CVE-2020-1351, CVE-2020-1352, CVE-2020-1353, CVE-2020-1354, CVE-2020-1355, CVE-2020-1356, CVE-2020-1357, CVE-2020-1358, CVE-2020-1359, CVE-2020-1360, CVE-2020-1361, CVE-2020-1362, CVE-2020-1363, CVE-2020-1364, CVE-2020-1365, CVE-2020-1366, CVE-2020-1367, CVE-2020-1368, CVE-2020-1369, CVE-2020-1370, CVE-2020-1371, CVE-2020-1372, CVE-2020-1373, CVE-2020-1374, CVE-2020-1375, CVE-2020-1381, CVE-2020-1382, CVE-2020-1384, CVE-2020-1385, CVE-2020-1386, CVE-2020-1387, CVE-2020-1388, CVE-2020-1389, CVE-2020-1390, CVE-2020-1391, CVE-2020-1392, CVE-2020-1393, CVE-2020-1394, CVE-2020-1395, CVE-2020-1396, CVE-2020-1397, CVE-2020-1398, CVE-2020-1399, CVE-2020-1400, CVE-2020-1401, CVE-2020-1402, CVE-2020-1404, CVE-2020-1405, CVE-2020-1406, CVE-2020-1407, CVE-2020-1408, CVE-2020-1409, CVE-2020-1410, CVE-2020-1411, CVE-2020-1412, CVE-2020-1413, CVE-2020-1414, CVE-2020-1415, CVE-2020-1418, CVE-2020-1419, CVE-2020-1420, CVE-2020-1421, CVE-2020-1422, CVE-2020-1423, CVE-2020-1424, CVE-2020-1426, CVE-2020-1427, CVE-2020-1428, CVE-2020-1429, CVE-2020-1430, CVE-2020-1431, CVE-2020-1434, CVE-2020-1435, CVE-2020-1436, CVE-2020-1437, CVE-2020-1438, CVE-2020-1463, CVE-2020-1468
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft releases the security update for Windows July 2020
The KB Articles associated with the update:
KB4558998
KB4565483
KB4565489
KB4565503
KB4565508
KB4565511
KB4565513
KB4565524
KB4565529
KB4565535
KB4565536
KB4565537
KB4565539
KB4565540
KB4565541
QID Detection Logic (Authenticated):
This QID checks for the file version of ntoskrnl.exe
The following versions of ntoskrnl.exe with their corresponding KBs are verified:
KB4565489 - 10.0.17134.1610
KB4565524 - 6.1.7601.24557
KB4558998 - 10.0.17763.1339
KB4565539 - 6.1.7601.24557
KB4565537 - 6.2.9200.23084
KB4565511 - 10.0.14393.3808
KB4565535 - 6.2.9200.23084
KB4565529 - 6.0.6003.20881
KB4565483 - 10.0.18362.959
KB4565541 - 6.3.9600.19761
KB4565540 - 6.3.9600.19761
KB4565508 - 10.0.16299.1992
KB4565536 - 6.0.6003.20881
KB4565513 - 10.0.10240.18638
- Consequence
- An attacker who successfully exploited this vulnerability could take control of the affected system
- Solution
-
Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Security Update Guide Windows
-
Microsoft Windows Servicing Stack Security Update July 2020
- Severity
- Serious 3
- Qualys ID
- 91655
- Vendor Reference
- ADV990001
- CVE Reference
- N/A
- CVSS Scores
- Base 6.8 / Temporal 5
- Description
-
Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes.
Microsoft has released Servicing Stack security updates for Windows 8.1, Windows 7, Windows 10,Windows Server 2008,Windows Server 2012,Windows Server 2016,Windows Server 2019.
QID Detection Logic (Authenticated):
This authenticated QID will check for file version of CbsCore.dll - Consequence
-
Successful exploitation may allow unauthorized disclosure of information, unauthorized modification or disruption of service.
- Solution
-
Customers are advised to refer to advisory ADV990001 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
ADV990001
-
Microsoft Edge Security Update for July 2020
- Severity
- Critical 4
- Qualys ID
- 91656
- Vendor Reference
- KB4558998, KB4565483, KB4565489, KB4565503, KB4565508, KB4565511, KB4565513
- CVE Reference
- CVE-2020-1433, CVE-2020-1462
- CVSS Scores
- Base 4.3 / Temporal 3.2
- Description
-
Microsoft releases the security update for Microsoft Edge July 2020
The KB Articles associated with the update:
KB4558998
KB4565483
KB4565489
KB4565503
KB4565508
KB4565511
KB4565513
QID Detection Logic:Authenticated
This QID checks for the file version of edgehtml.dll - Consequence
- On successfull exploitation,an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Solution
-
Please refer to the CVE-2020-1433 for more information pertaining to these vulnerabilities.
Please refer to the CVE-2020-1462 for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2020-1433
CVE-2020-1462
-
Microsoft Visual Studio Security Update for July 2020
- Severity
- Critical 4
- Qualys ID
- 91657
- Vendor Reference
- CVE-2020-1147, CVE-2020-1393, CVE-2020-1416
- CVE Reference
- CVE-2020-1147, CVE-2020-1393, CVE-2020-1416
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
Microsoft has released security update for Visual Studio which resolves multiple security vulnerabilities.
Affected Software:
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
Microsoft Visual Studio 2019 version 16.6 (includes 16.0 - 16.5)
Microsoft Visual Studio 2019 version 16.0
Microsoft Visual Studio 2015 Update 3QID Detection Logic: Authenticated
This QID detects vulnerable versions of Microsoft Visual Studio by checking file version of devenv.exe.NOTE: Microsoft Visual Studio 2015 Update 3 is only prone to CVE-2020-1393.
- Consequence
- Successful exploitation can affect confidentiality, integrity and availability.
- Solution
-
Customers are advised to refer to CVE-2020-1393 CVE-2020-1416 CVE-2020-1147 for more information pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2020-1147 Windows
CVE-2020-1393 Windows
CVE-2020-1416 Windows
-
Microsoft .NET Framework And .NET Core Security Updates for July 2020
- Severity
- Critical 4
- Qualys ID
- 91658
- Vendor Reference
- .NET Core July 2020, KB4565489, KB4565508, KB4565627, KB4565628, KB4565630, KB4565631, KB4565633, KB4566466, KB4566467, KB4566468, KB4566469, KB4566516, KB4566517, KB4566518, KB4566519, KB4566520
- CVE Reference
- CVE-2020-1147
- CVSS Scores
- Base 6.8 / Temporal 5.3
- Description
-
A remote code execution vulnerability exists in .NET Framework and .NET Core when the software fails to check the source markup of XML file input.
KB4565489,KB4565508,KB4565627,KB4565628,KB4565630,KB4565631,KB4565633,KB4566466,KB4566467,KB4566468,KB4566469,KB4566516,KB4566517,KB4566518,KB4566519,KB4566520 kbs and .Net Core are covered. This security update is rated Critical for supported versions of Microsoft .NET Framework and .NET Core.
.NET Framework 2.0, 3.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 and 4.8
Any .NET Core 2.1 application running on .NET Core 2.1.19 or lower
.Any .NET Core 3.1 application running on .NET Core 3.1.5 or lower
Any .NET 5 application running on .NET 5 Preview 6 or lowerQID Detection Logic (Authenticated):
- Checks for vulnerable version of System.data.dll for .Net Framework
- Checks for sub directories under %programfiles%\dotnet\shared\Microsoft.NETCore.App, %programfiles(x86)%\dotnet\shared\Microsoft.NETCore.App and checks for vulnerable versions in .version file on windows. - Consequence
- An attacker who successfully exploited the vulnerability can run arbitrary code in the context of the process responsible for deserialization of the XML content.
- Solution
-
Customers are advised to refer to CVE-2020-1147 for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2020-1147
-
Microsoft Defender Elevation of Privilege Vulnerability July 2020
- Severity
- Serious 3
- Qualys ID
- 91660
- Vendor Reference
- CVE-2020-1461
- CVE Reference
- CVE-2020-1461
- CVSS Scores
- Base 3.6 / Temporal 2.7
- Description
-
An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.
Affected Software:
Microsoft Forefront Endpoint Protection 2010
Microsoft Security Essentials
Microsoft System Center 2012 Endpoint Protection
Microsoft System Center 2012 R2 Endpoint Protection
Microsoft System Center Endpoint Protection
Windows DefenderQID Detection Logic (Authenticated):
The authenticated check looks for vulnerable version of file C:\WINDOWS\System32\MpSigStub.exe MpSigStub.exe. - Consequence
-
Successful exploitation allows attacker to delete arbitrary files on the system.
- Solution
-
Users are advised to check CVE-2020-1461 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2020-1461
-
Microsoft Windows DNS Server Remote Code Execution Vulnerability (CVE-2020-1350)(SIGRed)
- Severity
- Urgent 5
- Qualys ID
- 91662
- Vendor Reference
- CVE-2020-1350
- CVE Reference
- CVE-2020-1350
- CVSS Scores
- Base 10 / Temporal 8.3
- Description
-
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests.
The KB Articles associated with the update:
KB4565537
KB4565511
KB4565503
KB4565535
KB4565483
KB4565524
KB4565536
KB4558998
KB4565541
KB4565539
KB4565529
KB4565540
QID Detection Logic (Authenticated):
This QID checks for the file version of dns.exe.
NOTE: Detection is not checking for workaround, as long as device is missing the patch regardless of workaround mitigation status, this QID will flag.QID Detection Logic (Unauthenticated):
This QID compares the self-reported DNS banner version with patched versions to detect if the patch is installed
The following versions of dns.exe with their corresponding KBs are verified:
KB4565537 - 6.2.9200.23084
KB4565511 - 10.0.14393.3808
KB4565535 - 6.2.9200.23084
KB4565524 - 6.1.7601.24557
KB4565536 - 6.0.6003.20885
KB4565541 - 6.3.9600.19759
KB4565539 - 6.1.7601.24557
KB4565529 - 6.0.6003.20885
KB4565540 - 6.3.9600.19759
- Consequence
- An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account.
- Solution
-
Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Security Update Guide Windows(DNS)
These new vulnerability checks are included in Qualys vulnerability signature 2.4.937-4. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 100408
- 110354
- 110355
- 110356
- 110357
- 45451
- 91653
- 91655
- 91656
- 91657
- 91658
- 91660
- 91662
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.