logo
DATABASE RESOURCES PRICING ABOUT US

Microsoft Fixes RCE Flaws in Out-of-Band Windows Update

2020-10-16T20:47:02

Description

Microsoft has issued out-of-band patches for two “important” severity vulnerabilities, which if exploited could allow for remote code execution. One flaw (CVE-2020-17023) exists in Microsoft’s Visual Studio Code is a free source-code editor made by Microsoft for Windows, Linux and macOS. The other (CVE-2020-17022) is in the Microsoft Windows Codecs Library; the codecs module provides stream and file interfaces for transcoding data in Windows programs. “Microsoft has released security updates to address remote code execution vulnerabilities affecting Windows Codecs Library and Visual Studio Code,” according to [a Friday CISA alert on the patches](<https://us-cert.cisa.gov/ncas/current-activity/2020/10/16/microsoft-releases-security-updates-address-remote-code-execution>). “An attacker could exploit these vulnerabilities to take control of an affected system.” [![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>) According to Microsoft, one “important” severity flaw ([CVE-2020-17022](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17022>)) stems from the way that Microsoft Windows Codecs Library handles objects in memory. This vulnerability has a CVSS score of 7.8 out of 10. An attacker who successfully exploited the vulnerability could execute arbitrary code, according to Microsoft. While an attacker could be remote to launch the attack, exploitation requires that a program process a specially crafted image file. Only customers who have installed the optional HEVC or “HEVC from Device Manufacturer” media codecs from Microsoft Store may be vulnerable. The secure Microsoft installed packed versions are 1.0.32762.0, 1.0.32763.0, and later. “The update addresses the vulnerability by correcting how Microsoft Windows Codecs Library handles objects in memory,” according to Microsoft. The other “important” severity flaw (which also has a CVSS score of 7.8 out of 10) exists in Visual Studio Code, when a user is tricked into opening a malicious ‘package.json’ file. According to Microsoft, an attacker who successfully exploited this flaw ([CVE-2020-17023](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17023>)) could run arbitrary code in the context of the current user. An attacker would first need to convince a target to clone a repository and open it in Visual Studio Code (via social engineering or otherwise). The attacker’s malicious code would execute when the target opens the malicious ‘package.json’ file. “If the current user is logged on with administrative user rights, an attacker could take control of the affected system,” said Microsoft. “An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.” Microsoft’s update addresses the vulnerability by modifying the way Visual Studio Code handles JSON files. In a Twitter thread, Justin Steven, who reported the flaw, said that the issue stems from a bypass of a previously deployed patch for an RCE flaw in Visual Studio Code (CVE-2020-16881). > Microsoft Visual Studio Code seems to have botched the fix for CVE-2020-16881, a "remote code execution" vulnerability regarding "malicious package.json files". The patch can be trivially bypassed. A thread 🧵 > > — GNU/JUSTIN (@justinsteven) [October 2, 2020](<https://twitter.com/justinsteven/status/1312152915344195584?ref_src=twsrc%5Etfw>) Neither flaw has been observed being exploited in the wild according to Microsoft. Microsoft also did not offer mitigations or workarounds for other flaws – but updates will be automatically installed for users. “Affected customers will be automatically updated by Microsoft Store,” according to Microsoft. “Customers do not need to take any action to receive the update.” The fixes come days after [Microsoft’s October Patch Tuesday updates](<https://threatpost.com/october-patch-tuesday-wormable-bug/160044/>), during which it released fixes for 87 security vulnerabilities, 11 of them critical – and one potentially wormable. In the case of these bugs, “servicing for store apps/components does not follow the monthly ‘Update Tuesday’ cadence, but are offered whenever necessary,” according to Microsoft.


Related


cisa
info

Microsoft Releases Security Updates to Address Remote Code Execution Vulnerabilities

2020-10-16T00:00:00
nessus
scanner

Security Update for Microsoft Visual Studio Code (CVE-2020-17023)

2020-10-27T00:00:00
nessus
scanner

Security Update for Microsoft Visual Studio Code (CVE-2020-16881)

2020-09-08T00:00:00
nessus
scanner

Microsoft Windows Codecs Library RCE (October 2020)

2020-11-06T00:00:00
mscve
microsoft

Visual Studio JSON Remote Code Execution Vulnerability

2020-10-15T07:00:00
mscve
microsoft

Visual Studio JSON Remote Code Execution Vulnerability

2020-09-08T07:00:00
mscve
microsoft

Microsoft Windows Codecs Library Remote Code Execution Vulnerability

2020-10-15T07:00:00
kaspersky
info

KLA11980 ACE vulnerability in Microsoft Developer Tools

2020-10-15T00:00:00
kaspersky
info

KLA11981 ACE vulnerability in Microsoft Windows

2020-10-15T00:00:00
kaspersky
info

KLA11956 Multiple vulnerabilities in Microsoft Developer Tools

2020-09-08T00:00:00
cve
NVD

CVE-2020-17023

2020-10-16T23:15:00
cve
NVD

CVE-2020-16881

2020-09-11T17:15:00
cve
NVD

CVE-2020-17022

2020-10-16T23:15:00
avleonov
blog

Microsoft Patch Tuesday September 2020: Zerologon and other exploits, RCEs in SharePoint and Exchange

2020-09-30T23:46:21