March 2020 Patch Tuesday Update: 115 individual CVEs

Last month I commented on the sheer size of the fixed vulnerabilities in Microsoft’s February Patch Tuesday release. Well, leave it to Microsoft to one-up me on that number. The March release contains fixes for 115 individual CVEs—26 of which are rated “Critical” and 88 “Important”—with a spread across operating systems, browsers, applications, and a few interesting ones we’ll review here.

Critical operating system vulnerabilities

There are seven vulnerabilities marked “Critical” for operating systems. These include fixes for Server 2008 and Windows 7 that are only available via the Extended Security Updates (ESU). There are a few important things to note about this month’s “Critical” patches. They are all listed as “Exploitation Less Likely”, with no “Exploitation Detected” or “Exploitation More Likely” ratings. That usually indicates that Microsoft doesn’t expect these vulnerabilities to be exploited easily.

CVE-2020-0684 is a “Remote Code Execution” vulnerability that would allow an attacker to gain the same rights as a user if that user were tricked into clicking on a .LNK file. This vulnerability affects all operating systems from Windows 7 up to current versions of Windows 10, and their corresponding Server versions.

The next group consists of four Media Foundation Memory Corruption vulnerabilities. They all have the same description, stating that an attacker could convince a user to open a document or visit a malicious web page. This would give the attacker the ability to add, modify, create, or delete data or accounts on the affected systems. CVE-2020-0801, CVE-2020-0809, CVE-2020-0869, and CVE-2020-0807 affect Windows 10 versions, as well as the Server versions from 2016 up to current.

Finally, CVE-2020-0881 and CVE-2020-0883 are both in the Windows Graphics Device Interface (GDI) and are related to how objects are handled in memory. If a user were tricked into visiting a website or opening an attachment, this vulnerability would allow the attacker to gain full rights to the affected system. All versions from Windows 7 up to current (including Server operating systems) are impacted.

Browser vulnerabilities

There are 17 “Critical” vulnerabilities in browsers this month. Six of them are in Internet Explorer 11 on Windows 7 up to current Windows 10 versions, while 13 of them affect the “EdgeHTML” version of the Edge browser on Windows 10.

Other applications

There is a total of nine CVEs fixed in Office this month, one of which is marked “Critical”. CVE-2020-0852 is a “Remote Code Execution” vulnerability that would require a user to open a specially crafted file and would allow the attacker to gain the same permissions as the logged-on user. Microsoft notes that the Preview Pane is an attack vector for this one, so you may want to prioritize Office updates this month. This vulnerability affects Microsoft Office 2016 for Mac, SharePoint Server 2019, and Office 2019.

The remaining “Important” vulnerabilities are focused on “Remote Code Execution,” “Spoofing,” and one “Information Disclosure” vulnerability and affect versions of Office, including SharePoint Server, Word, and ProPlus.

Microsoft Exchange Server 2016 and 2019 have one “Important” cross-site-scripting vulnerability that would allow an attacker to act as another user. The fix for CVE-2020-0903 addresses how Exchange handles web requests. 

Microsoft Dynamics has a “Critical” vulnerability, CVE-2020-0905. This vulnerability is in Business Central, and the fix prevents the use of binary types that could execute code on the server itself.

Finally, Application Inspector has one fix for CVE-2020-0872 , which would allow an attacker to execute code if a user was tricked into running Inspector on that code.

In summary, with no active attacks at the time of this publishing, there are no real “emergencies” in this batch. Since most patches are cumulative on Windows 10, start your focus on internet facing workstations, then servers, and then Office.

As I mentioned last Patch Tuesday, we continue to see fixes for Windows 7, and without an ESU subscription, the risk continues to grow for those systems. It is recommended to upgrade to a supported operating system or purchase ESU for these systems. In a situation where that’s simply not possible, it’s critical to ensure other layers of security (Endpoint protection, Mail Protection, URL filtering, Firewall) are properly configured and protecting these systems.

As always, we recommend testing these patches on a small set of systems before approving them for wider deployment. 

Let’s stay safe out there!