Microsoft October 2020 Patch Tuesday fixes 87 flaws, including 21 RCEs

Microsoft October 2020 Patch Tuesday security updates address 87 vulnerabilities, including 21 remote code execution (RCE) issues.

Microsoft October 2020 Patch Tuesday security updates address 87 vulnerabilities, including 21 remote code execution (RCE) issues.

The remote code execution (RCE) flaws fixed by Microsoft affects multiple products, including Excel, Outlook, the Windows Graphics component, and the Windows TCP/IP stack.

The most severe vulnerability is an RCE issue tracked as CVE-2020-16898. that resides in the Windows TCP/IP stack. The vulnerability can be exploited by the attackers to take over Windows systems by sending malicious ICMPv6 Router Advertisement packets to an unpatched system via a network connection.

“A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could gain the ability to execute code on the target server or client.” reads the security advisory published by Microsoft.

“To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer.”

The vulnerability received a score of 9.8 out of a maximum of 10, it affects Windows 10 and Windows Server 2019.

Microsoft also provided some workarounds such as disabling ICMPv6 RDNSS support.

Another severe RCE flaw, tracked as CVE-2020-16947, affects MS Outlook and can be exploited by attackers by tricking a user to open a specially crafted file with a vulnerable version of Outlook.

“A remote code execution vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.” reads the advisory.

“Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Outlook software.”

The list of the vulnerabilities addressed with the release of the October 2020 Patch Tuesday updates is available on the Security Update Guide portal.

Pierluigi Paganini

(SecurityAffairs – hacking, October 2020 Patch Tuesday)

---