KLA11811 Multiple vulnerabilities in Microsoft System Center

Multiple vulnerabilities were found in Microsoft System Center. Malicious users can exploit these vulnerabilities to gain privileges, spoof user interface.

Below is a complete list of vulnerabilities:

1. An elevation of privilege vulnerability in Microsoft Windows Defender can be exploited remotely via specially crafted application to gain privileges.
2. A spoofing vulnerability in System Center Operations Manager can be exploited remotely via specially crafted web to spoof user interface.

Original advisories

CVE-2020-1163

CVE-2020-1170

CVE-2020-1331

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-System-Center-Operations-Manager

CVE list

CVE-2020-1163 high

CVE-2020-1170 high

CVE-2020-1331 warning

KB list

4566040

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft System Center Endpoint ProtectionWindows DefenderSystem Center 2016 Operations ManagerMicrosoft Security EssentialsMicrosoft Forefront Endpoint Protection 2010Microsoft System Center 2012 Endpoint ProtectionMicrosoft System Center 2012 R2 Endpoint Protection