Microsoft released patches for 87 newly discovered vulnerabilities on its October 2020 Patch Tuesday.
Of the 87 vulnerabilities fixed today, 12 are classified as Critical, and 74 are classified as Important, and one as moderate.
The October security release consists of security updates for the following software:
- Microsoft Windows
- Microsoft Office and Microsoft Office Services and Web Apps
- Microsoft JET Database Engine
- Azure Functions
- Open Source Software
- Microsoft Exchange Server
- Visual Studio
- PowerShellGet
- Microsoft .NET Framework
- Microsoft Dynamics
- Adobe Flash Player
- Microsoft Windows Codecs Library
CVE-2020-16898 – Bad Neighbor TCP/IP Stack
A remote code execution vulnerability with CVSS score 9.8, exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could gain the ability to execute code on the target server or client.
To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer.
On the latest post from McAfee security researchers “exploit that would grant remote code execution would be widespread and highly impactful, as this type of bug could be made wormable.”
Bharat Jogi, senior manager of vulnerability and threat research at Qualys, said that an exploit for the bug could be self-propagating, worming through infrastructure without user interaction.
CVE-2020-16947 – Microsoft Outlook Vulnerability
A second vulnerability to keep track of CVE-2020-16947, which concerns an RCE flaw on affected versions of Outlook that could allow code execution just by viewing a specially crafted email.
Microsoft also noted in its advisory that, “If the current user is logged on with administrative user rights, an attacker could take control of the affected system,” and “An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”
CVE-2020-16909 – Windows Error Reporting Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.
An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application.
Below is the full list of resolved vulnerabilities and released advisories in the October 2020 Patch Tuesday updates.
| Tag | CVE ID | CVE Title | Severity |
| .NET Framework | CVE-2020-16937 | .NET Framework Information Disclosure Vulnerability | Important |
| Adobe Flash Player | ADV200012 | October 2020 Adobe Flash Security Update | Critical |
| Azure | CVE-2020-16995 | Network Watcher Agent Virtual Machine Extension for Linux Elevation of Privilege Vulnerability | Important |
| Azure | CVE-2020-16904 | Azure Functions Elevation of Privilege Vulnerability | Important |
| Group Policy | CVE-2020-16939 | Group Policy Elevation of Privilege Vulnerability | Important |
| Microsoft Dynamics | CVE-2020-16978 | Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability | Important |
| Microsoft Dynamics | CVE-2020-16956 | Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability | Important |
| Microsoft Dynamics | CVE-2020-16943 | Dynamics 365 Commerce Elevation of Privilege Vulnerability | Important |
| Microsoft Exchange Server | CVE-2020-16969 | Microsoft Exchange Information Disclosure Vulnerability | Important |
| Microsoft Graphics Component | CVE-2020-16911 | GDI+ Remote Code Execution Vulnerability | Critical |
| Microsoft Graphics Component | CVE-2020-16914 | Windows GDI+ Information Disclosure Vulnerability | Important |
| Microsoft Graphics Component | CVE-2020-16923 | Microsoft Graphics Components Remote Code Execution Vulnerability | Critical |
| Microsoft Graphics Component | CVE-2020-1167 | Microsoft Graphics Components Remote Code Execution Vulnerability | Important |
| Microsoft NTFS | CVE-2020-16938 | Windows Kernel Information Disclosure Vulnerability | Important |
| Microsoft Office | CVE-2020-16933 | Microsoft Word Security Feature Bypass Vulnerability | Important |
| Microsoft Office | CVE-2020-16929 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-16934 | Microsoft Office Click-to-Run Elevation of Privilege Vulnerability | Important |
| Microsoft Office | CVE-2020-16932 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-16930 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-16955 | Microsoft Office Click-to-Run Elevation of Privilege Vulnerability | Important |
| Microsoft Office | CVE-2020-16928 | Microsoft Office Click-to-Run Elevation of Privilege Vulnerability | Important |
| Microsoft Office | CVE-2020-16957 | Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-16918 | Base3D Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-16949 | Microsoft Outlook Denial of Service Vulnerability | Moderate |
| Microsoft Office | CVE-2020-16947 | Microsoft Outlook Remote Code Execution Vulnerability | Critical |
| Microsoft Office | CVE-2020-16931 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-16954 | Microsoft Office Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-17003 | Base3D Remote Code Execution Vulnerability | Critical |
| Microsoft Office SharePoint | CVE-2020-16948 | Microsoft SharePoint Information Disclosure Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16953 | Microsoft SharePoint Information Disclosure Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16942 | Microsoft SharePoint Information Disclosure Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16951 | Microsoft SharePoint Remote Code Execution Vulnerability | Critical |
| Microsoft Office SharePoint | CVE-2020-16944 | Microsoft SharePoint Reflective XSS Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16945 | Microsoft Office SharePoint XSS Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16946 | Microsoft Office SharePoint XSS Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16941 | Microsoft SharePoint Information Disclosure Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16950 | Microsoft SharePoint Information Disclosure Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16952 | Microsoft SharePoint Remote Code Execution Vulnerability | Critical |
| Microsoft Windows | CVE-2020-16900 | Windows Event System Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16901 | Windows Kernel Information Disclosure Vulnerability | Important |
| Microsoft Windows | CVE-2020-16899 | Windows TCP/IP Denial of Service Vulnerability | Important |
| Microsoft Windows | CVE-2020-16908 | Windows Setup Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16909 | Windows Error Reporting Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16912 | Windows Backup Service Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16940 | Windows – User Profile Service Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16907 | Win32k Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16936 | Windows Backup Service Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16898 | Windows TCP/IP Remote Code Execution Vulnerability | Critical |
| Microsoft Windows | CVE-2020-16897 | NetBT Information Disclosure Vulnerability | Important |
| Microsoft Windows | CVE-2020-16895 | Windows Error Reporting Manager Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16919 | Windows Enterprise App Management Service Information Disclosure Vulnerability | Important |
| Microsoft Windows | CVE-2020-16921 | Windows Text Services Framework Information Disclosure Vulnerability | Important |
| Microsoft Windows | CVE-2020-16920 | Windows Application Compatibility Client Library Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16972 | Windows Backup Service Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16877 | Windows Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16876 | Windows Application Compatibility Client Library Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16975 | Windows Backup Service Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16973 | Windows Backup Service Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16974 | Windows Backup Service Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16922 | Windows Spoofing Vulnerability | Important |
| Microsoft Windows | CVE-2020-0764 | Windows Storage Services Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16980 | Windows iSCSI Target Service Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-1080 | Windows Hyper-V Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16887 | Windows Network Connections Service Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16885 | Windows Storage VSP Driver Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16924 | Jet Database Engine Remote Code Execution Vulnerability | Important |
| Microsoft Windows | CVE-2020-16976 | Windows Backup Service Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2020-16935 | Windows COM Server Elevation of Privilege Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2020-16967 | Windows Camera Codec Pack Remote Code Execution Vulnerability | Critical |
| Microsoft Windows Codecs Library | CVE-2020-16968 | Windows Camera Codec Pack Remote Code Execution Vulnerability | Critical |
| PowerShellGet | CVE-2020-16886 | PowerShellGet Module WDAC Security Feature Bypass Vulnerability | Important |
| Visual Studio | CVE-2020-16977 | Visual Studio Code Python Extension Remote Code Execution Vulnerability | Important |
| Windows COM | CVE-2020-16916 | Windows COM Server Elevation of Privilege Vulnerability | Important |
| Windows Error Reporting | CVE-2020-16905 | Windows Error Reporting Elevation of Privilege Vulnerability | Important |
| Windows Hyper-V | CVE-2020-16894 | Windows NAT Remote Code Execution Vulnerability | Important |
| Windows Hyper-V | CVE-2020-1243 | Windows Hyper-V Denial of Service Vulnerability | Important |
| Windows Hyper-V | CVE-2020-16891 | Windows Hyper-V Remote Code Execution Vulnerability | Critical |
| Windows Installer | CVE-2020-16902 | Windows Installer Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2020-16889 | Windows KernelStream Information Disclosure Vulnerability | Important |
| Windows Kernel | CVE-2020-16892 | Windows Image Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2020-16913 | Win32k Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2020-1047 | Windows Hyper-V Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2020-16910 | Windows Security Feature Bypass Vulnerability | Important |
| Windows Media Player | CVE-2020-16915 | Media Foundation Memory Corruption Vulnerability | Critical |
| Windows RDP | CVE-2020-16863 | Windows Remote Desktop Service Denial of Service Vulnerability | Important |
| Windows RDP | CVE-2020-16927 | Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability | Important |
| Windows RDP | CVE-2020-16896 | Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability | Important |
| Windows Secure Kernel Mode | CVE-2020-16890 | Windows Kernel Elevation of Privilege Vulnerability | Important |
It’s highly recommended that Windows users and System Administrators apply the latest security patches to mitigate the threats associated with these issues.
Leave A Comment