Microsoft September 2020 Patch Tuesday fixes 129 vulnerabilities
Twenty critical remote code execution bugs have been patched this month, including in Windows and SharePoint enterprise servers.
Microsoft has published today its monthly batch of security updates, also known as Patch Tuesday. This month, the OS maker patched 129 vulnerabilities across 15 products, ranging from Windows to ASP.NET.
Of note is that this month, of the 129 vulnerabilities, 32 were classified as remote code execution issues, which are bugs that permit attackers to exploit vulnerable applications remotely, over a network.
Of these 32, 20 also received a severity classification of “critical,” the highest rating on Microsoft’s scale, making the 20 vulnerabilities some of the most important bugs patched across Microsoft products this month.The list of 20 critical RCEs includes bugs in:
- Windows (CVE-2020-1252)
- On-premise Microsoft Dynamics 365 systems (CVE-2020-16857, CVE-2020-16862)
- Windows Graphics Device Interface (GDI) (CVE-2020-1285)
- Microsoft SharePoint (CVE-2020-1200, CVE-2020-1210, CVE-2020-1452, CVE-2020-1453, CVE-2020-1576, CVE-2020-1595)
- Microsoft SharePoint Server (CVE-2020-1460)
- Windows Media Audio Decoder (CVE-2020-1593, CVE-2020-1508)
- Microsoft COM for Windows (CVE-2020-0922)
- Windows Text Service Module (CVE-2020-0908)
- Microsoft Windows Codecs Library (CVE-2020-1319, CVE-2020-1129)
- Windows Camera Codec Pack (CVE-2020-0997)
- Visual Studio (CVE-2020-16874)
All of the vulnerabilities listed above are serious issues, and especially the ones impacting Windows (due to the huge attack surface) and SharePoint and Dynamics 365 (as these systems are often installed on large enterprise networks).
Malware authors are known to follow Microsoft’s monthly security updates, select the most useful/dangerous bugs, and patch-diff the updated components to find the exact bug Microsoft fixed — so they can weaponize it for future attacks.
System administrators are advised to review the threat posed by each of the RCE vulnerabilities listed above, and then decide if this month’s security updates need to be applied right away or delayed for additional testing.
