The July 2020 Security Update Review

July is upon us, and it brings another huge batch of security patches from Microsoft, and a few from Adobe as well. Take a break from your regularly scheduled activities and join us as we review the details for security patches for this month.

Adobe Patches for July 2020

This month, Adobe released five patches covering 13 CVEs in Adobe Cold Fusion, Download Manager, Genuine Service, Media Encoder, and the Creative Cloud Desktop Application. Three of these bugs came through the ZDI program. The update for Cold Fusion covers two DLL search-order hijacking bugs that could allow a privilege escalation. The fix for Download Manager corrects a single command injection vulnerability. The patch for Media Encoder address two Out-Of-Bounds (OOB) Write and an OOB Read bug. The OOB Write bugs could lead to arbitrary code execution if an attacker convinces a target to visit a malicious page or open a malicious file. The update for the Creative Cloud Desktop Application fixes four different bugs. The most severe of these would allow an arbitrary file system write, while the others could allow a privilege escalation. Finally, the patch for Adobe Genuine Service fixes three Important-severity privilege escalation vulnerabilities. None of the bugs fixed by Adobe are listed as publicly known or under active attack at the time of release.

Updated as on July 21, 2020

Just a week after its scheduled release, Adobe published four additional patches addressing 13 CVEs in Adobe Reader Mobile, Prelude, Photoshop, and Bridge. 12 of the 13 CVEs patched were reported by ZDI Researcher Mat Powell. The update for Reader Mobile fixes an Important severity directory traversal. The patch for Prelude fixes two Out-Of-Bounds (OOB) Read and two OOB Write bugs that could lead to code execution. The Photoshop patch also corrects Critical-rated OOB Read and OOB Write flaws. Finally, the patch for Adobe Bridge fixes three additional Critical-rated OOB Read and Write bugs. None of the bugs addressed today are listed as publicly known or under active attack at the time of release.

Microsoft Patches for July 2020

For July, Microsoft released patches for 123 CVEs and one advisory covering Microsoft Windows, Edge (EdgeHTML-based and Chromium-based) in IE Mode, ChakraCore, Internet Explorer (IE), Office and Office Services and Web Apps, Windows Defender, Skype for Business, Visual Studio, .NET Framework, OneDrive, Azure DevOp, and Open Source Software. That makes five straight months of 110+ CVEs released and brings the total for 2020 up to 742. For comparison, Microsoft released patches for 851 CVEs in all of 2019. At this pace, Microsoft will eclipse that number next month. They have already passed their totals for 2017 (665) and 2018 (691).

Of these 123 patches, 18 are listed as Critical and 105 are listed as Important in severity. Seven of these bugs came through the ZDI program. None of these bugs are listed as being under attack at the time of release, while one CVE is listed as publicly known. Let’s take a closer look at some of the more interesting updates for this month, starting with a highly exploitable bug in Windows DNS servers:

-       CVE-2020-1350 - Windows DNS Server Remote Code Execution Vulnerability
This patch fixes a CVSS 10 rated bug in the Windows DNS Server service that could allow unauthenticated code execution at the level of Local System account if an affected system received a specially crafted request. That makes this bug wormable – at least between affected DNS servers. Microsoft also suggests a registry edit that limits the size of TCP packets the server will process as a workaround, but they don’t list any potential side effects of that registry change. The attack vector requires very large DNS packets, so attacks cannot be conducted over UDP. Considering Windows DNS servers are usually also Domain Controllers, definitely get this patched as soon as you can.

-       CVE-2020-1025 - Microsoft Office Elevation of Privilege Vulnerability
It’s rare to see an Elevation of Privilege (EoP) bug rated Critical in severity, but this vulnerability in SharePoint and Skype for Business servers certainly earns its rating. An attacker could use this to gain access to an affected server through the improper handling of an OAuth token. Lync servers are also impacted by this, so if you have one of those left around, patch and then seriously consider upgrading to something newer.

-       CVE-2020-1147 - .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability
A problem with the way XML source markup is checked could lead to RCE in .NET, SharePoint, and Visual Studio. This also seems to be related to CVE-2020-1439, as both list the core problem residing in the “DataSet” and “DataTable” types which are .NET components used to manage data sets. Either way, all patches are needed to fully address this bug, and that could make servicing difficult. At least it appears the patches may be installed in any order.

-       CVE-2020-1349 - Microsoft Outlook Remote Code Execution Vulnerability
This patch fixes a bug in Outlook that could allow an attacker to execute code at the level of the logged-on user if they open or view a specially crafted e-mail. What sets this vulnerability apart is the fact that just viewing the e-mail in the Preview Pane is enough to trigger the bug.

Here’s the full list of CVEs released by Microsoft for July 2020.

Of the remaining Critical-rated patches, we find another patch for LNK files. Considering this is the fourth one this year to be addressed, it seems likely one of the first three didn’t completely resolve the underlying vulnerability. Speaking of familiar bugs, there is another patch for RDP, but this one is only for the client side. While not wormable, an attacker could still get RCE on a target system if an affected system logged in to a malicious server. There are six CVEs affecting Hyper-V, but there are no actual patches to fix the bug. The vulnerabilities all reside in the RemoteFX vGPU, which is no longer supported. The update provided simply removes RemoteFX. The remaining Critical-rated bugs affect different components, but all require either opening a crafted object or browsing to a malicious website.

The majority of this release concerns EoP bugs. These include a bug in the Windows SharedStream Library that is listed as publicly known. Although many different components are receiving patches, the exploit scenario is nearly identical. A local, authenticated attacker runs a specially crafted program to gain additional privileges. One thing to note is the July 2020 Servicing Stack Updates (SSUs) must be installed before patches for the Windows Modules Installer. The patches for the Mobile Device Management (MDM) Diagnostics don’t allow for code execution but could allow attackers to delete files they shouldn’t be able to access. There’s also a wrinkle in the update for Visual Studio. Instead of running a program, an attacker would need to place a file on the system then wait for the user to launch Visual Studio. The patches for Windows Defender should have already been applied to your systems as the engine updates as needed. If you have systems disconnected from the Internet, you’ll need to apply these patches by hand. EoP bugs submitted during the Spring Pwn2Own contest are also receiving patches this month.

There are 14 Important-rated RCEs getting fixes this month as well. For the most part, these need some form of user interaction, such as opening a file or browsing to a website. Those bugs that allow code execution by browsing to a website should be prioritized, as those could also be triggered by a malicious ad on an otherwise harmless site.

There are also 14 information disclosure bugs getting patched this month. For the most part, only uninitialized memory or memory layout is disclosed. For CVE-2020-1391, the write-up mentions disclosing “sensitive information,” but offers no clue as to what type of sensitive information that may be. There are two patches for Skype for Business that could disclose Skype profile data or other PII of the user. The patch for CVE-2020-1330 fixes a bug in the MDM Diagnostics that could allow an attacker to read from the file system. It’s not clear if the entire file system is open or only specific parts.

The release is rounded out with patches for a few cross-site scripting bugs and Denial-of-Service (DoS) bugs. Included in the DoS bugs is a new version of the .NET implementation of Bond. It’s strange to see Microsoft patches for open source software, but it’s a welcome event.

Looking at the advisories for July, the first is Microsoft’s Guidance for Enabling Request Smuggling Filter on IIS Servers (ADV200008). Failure to strictly adhere to the RFC could allow an unauthenticated attacker to tamper with requests and responses on an IIS website if they sent a specially crafted request to an affected IIS site serviced by a front-end load balancer or proxy. If you’re using a front-end load balancer or proxy, you should review the advisory to ensure malformed requests are not being passed to back-end servers. The other is the update to the Windows Servicing Stack, which adds updates for all supported versions of Windows.

Looking Ahead

The next Patch Tuesday falls on August 11, and we’ll return with details and patch analysis then. Until then, stay safe, enjoy your patching, and may all your reboots be smooth and clean!