Microsoft August 2020 Patch Tuesday fixed actively exploited zero-days

Microsoft August 2020 Patch Tuesday updates addressed 120 vulnerabilities, including two zero-days that have been exploited in attacks.

Microsoft August 2020 Patch Tuesday updates have addressed 120 flaws, including two zero-day vulnerabilities that have been exploited in attacks in the wild.

The two issues are a Windows spoofing bug and a remote code execution flaw in Internet Explorer.

The Windows spoofing flaw, tracked as CVE-2020-1464 can be exploited by an attacker to bypass security features and load improperly signed files. The flaw is related to Windows incorrectly validating file signatures.

“A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files.” reads the advisory published by Microsoft.

“In an attack scenario, an attacker could bypass security features intended to prevent improperly signed files from being loaded.”

The flaw affects many Windows OSs, including Windows 7 and Windows Server 2008, for which the IT giant will not provide security updates because the reached the end-of-life.

Microsoft confirmed that threat actors are actively exploiting the issues in attacks against Windows systems but it did not provide technical details about the attacks.

The second zero-day addressed by Microsoft is tracked as CVE-2020-1380, it is a remote code execution issue that affects the scripting engine used by Internet Explorer. The flaw is related to the way the engine handles objects in memory, it could be exploited by tricking victims into visiting a malicious website, or by opening a malicious Office document, or through a malvertising attack.

“A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.” reads the advisory. “An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system.”

The RCE vulnerability was discovered by security researchers at Kaspersky.

Microsoft also addressed other 15 critical vulnerabilities that impact Windows, the Edge and Internet Explorer browsers, Outlook, and the .NET framework. Most of the vulnerabilities are remote code execution issues.

Microsoft August 2020 Patch Tuesday also fixed over 100 vulnerabilities, rated as important, impacting Windows, Dynamics 365, Office, Outlook, SharePoint, and Visual Studio Code. These flaws can be exploited for remote code execution, privilege escalation, XSS attacks, DoS attacks, and to disclose information.

The full list of flaws addressed by Microsoft August 2020 Patch Tuesday is available here.

Pierluigi Paganini

(SecurityAffairs – hacking, Microsoft August 2020 Patch Tuesday)