Skip to main content
SolarWinds MSP
  • Login
  • Support
  • Partnerships
    • Partnerships Overview
    • Solution Provider Program
    • Technology Alliance Program
    • Distributor Program
SolarWinds MSP
  • Products
    • SolarWinds N-central Automate what you need. Tackle complex networks. Try this remote monitoring and management solution built to help maximize efficiency and scale.
    • SolarWinds RMM Start fast. Grow at your own pace. Try this powerful but simple remote monitoring and management solution.
    • SolarWinds EDR Defend against ransomware, zero-day attacks, and evolving online threats with Endpoint Detection and Response
    • SolarWinds Backup Manage data protection for servers, workstations applications, documents and Microsoft 365 from one SaaS dashboard.
    • Mail Protection & Archiving Protect users from email threats and downtime.
    • Password Management Easily adopt and demonstrate best practice password and documentation management workflows.
      • Passportal Demo
    • PSA & Ticketing Manage ticketing, reporting, and billing to increase helpdesk efficiency.
    • Remote Support Help support customers and their devices with remote support tools designed to be fast and powerful.
  • Solutions

    I'm looking for...

    • Security Solutions
    • Monitoring Solutions
    • Efficiency Solutions
  • Resources
    • Blog
    • Webcasts & Events
    • Ask the N-central Experts
    • Daily Live Demos
    • RMM Foundations Training
    • Upcoming Events
    • Upcoming Webcasts
    • Resource Center
    • COVID-19 Resources
    • Resource Library
      • Case Studies
      • Product Information
      • eBooks
      • White Papers
      • Infographics
    • SolarWinds MSP Free Tools
    • GDPR Resource Center
    • Security Resource Center
    • MSP Institute Webinar Series
    • MSP Advice Project
  • About
    • Contact
    • Customer Success
    • Worldwide sales and support
    • Careers
    • Awards and Recognition
    • Get A Quote
    • Newsroom
      • Press Releases
      • In The News
      • Media Contacts
      • COVID-19 Response
    • Leadership Team
    • Legal
      • Cookie Policy
      • Privacy Notice
      • Software Services Agreement
      • Terms of Use
      • Backup Fair Use Policy
    • Security
      • SolarWinds Security Statement
      • Vendor Data Protection Requirements
    • Support
  • IT Departments
  • Contact Sales
    • Get A Quote
    • General Inquiry
  • TRY NOW
    • SolarWinds RMM
    • SolarWinds Backup
    • MSP Manager
    • SolarWinds Passportal
    • SolarWinds N-central
    • SolarWinds Mail Assure
    • SolarWinds Risk Intelligence
    • SolarWinds Take Control
  • Request a Quote
  • Try Now
    • SolarWinds RMM
    • SolarWinds N-central
    • SolarWinds Backup
    • MSP Manager
    • SolarWinds Mail Assure
    • SolarWinds Passportal
    • SolarWinds Risk Intelligence
    • SolarWinds Take Control
Request quote
Filter Blogs
  • Filter by:
  • MSP Business
    • Automation
    • Backup & Disaster Recovery
    • Security-series
    • Best Practices
    • Business
    • Business Growth
    • Business Risk
    • Cloud Computing
    • Customer Service
    • Cybersecurity
    • Cybersecurity Awareness Month
    • Data
    • GDPR
    • Internet of Things
    • IT Support
    • ITSM
    • LOGICcards
    • Machine Learning
    • Mail
    • Managed Services
    • Marketing
    • Mobile
    • Networking
    • Operations
    • Podcast
    • Product
    • PSA
    • Remote Management
    • Research & Trends
    • Risk Intelligence
    • Security
    • Security Vlog
    • Service Desk
    • Services & Support
    • The Head Nerds
    • Tips & Advice
    • Training
Home Blog MSP Business Security March 2020 Patch Tuesday Update: 115 individual CVEs
Security

March 2020 Patch Tuesday Update: 115 individual CVEs

By Gill Langston
11 March, 2020

Last month I commented on the sheer size of the fixed vulnerabilities in Microsoft’s February Patch Tuesday release. Well, leave it to Microsoft to one-up me on that number. The March release contains fixes for 115 individual CVEs—26 of which are rated “Critical” and 88 “Important”—with a spread across operating systems, browsers, applications, and a few interesting ones we’ll review here.

Critical operating system vulnerabilities

There are seven vulnerabilities marked “Critical” for operating systems. These include fixes for Server 2008 and Windows 7 that are only available via the Extended Security Updates (ESU). There are a few important things to note about this month’s “Critical” patches. They are all listed as “Exploitation Less Likely”, with no “Exploitation Detected” or “Exploitation More Likely” ratings. That usually indicates that Microsoft doesn’t expect these vulnerabilities to be exploited easily.

CVE-2020-0684 is a “Remote Code Execution” vulnerability that would allow an attacker to gain the same rights as a user if that user were tricked into clicking on a .LNK file. This vulnerability affects all operating systems from Windows 7 up to current versions of Windows 10, and their corresponding Server versions.

The next group consists of four Media Foundation Memory Corruption vulnerabilities. They all have the same description, stating that an attacker could convince a user to open a document or visit a malicious web page. This would give the attacker the ability to add, modify, create, or delete data or accounts on the affected systems. CVE-2020-0801, CVE-2020-0809, CVE-2020-0869, and CVE-2020-0807 affect Windows 10 versions, as well as the Server versions from 2016 up to current.

Finally, CVE-2020-0881 and CVE-2020-0883 are both in the Windows Graphics Device Interface (GDI) and are related to how objects are handled in memory. If a user were tricked into visiting a website or opening an attachment, this vulnerability would allow the attacker to gain full rights to the affected system. All versions from Windows 7 up to current (including Server operating systems) are impacted.

Browser vulnerabilities

There are 17 “Critical” vulnerabilities in browsers this month. Six of them are in Internet Explorer 11 on Windows 7 up to current Windows 10 versions, while 13 of them affect the “EdgeHTML” version of the Edge browser on Windows 10.

Other applications

There is a total of nine CVEs fixed in Office this month, one of which is marked “Critical”. CVE-2020-0852 is a “Remote Code Execution” vulnerability that would require a user to open a specially crafted file and would allow the attacker to gain the same permissions as the logged-on user. Microsoft notes that the Preview Pane is an attack vector for this one, so you may want to prioritize Office updates this month. This vulnerability affects Microsoft Office 2016 for Mac, SharePoint Server 2019, and Office 2019.

The remaining “Important” vulnerabilities are focused on “Remote Code Execution,” “Spoofing,” and one “Information Disclosure” vulnerability and affect versions of Office, including SharePoint Server, Word, and ProPlus.

Microsoft Exchange Server 2016 and 2019 have one “Important” cross-site-scripting vulnerability that would allow an attacker to act as another user. The fix for CVE-2020-0903 addresses how Exchange handles web requests. 

Microsoft Dynamics has a “Critical” vulnerability, CVE-2020-0905. This vulnerability is in Business Central, and the fix prevents the use of binary types that could execute code on the server itself.

Finally, Application Inspector has one fix for CVE-2020-0872 , which would allow an attacker to execute code if a user was tricked into running Inspector on that code.

In summary, with no active attacks at the time of this publishing, there are no real “emergencies” in this batch. Since most patches are cumulative on Windows 10, start your focus on internet facing workstations, then servers, and then Office.

As I mentioned last Patch Tuesday, we continue to see fixes for Windows 7, and without an ESU subscription, the risk continues to grow for those systems. It is recommended to upgrade to a supported operating system or purchase ESU for these systems. In a situation where that’s simply not possible, it’s critical to ensure other layers of security (Endpoint protection, Mail Protection, URL filtering, Firewall) are properly configured and protecting these systems.

As always, we recommend testing these patches on a small set of systems before approving them for wider deployment. 

Let’s stay safe out there!

 

Additional Reading

February 2020 Patch Tuesday Update:  One of the Largest by Vulnerability Count
What are your options when a patch goes wrong?
Should You Leave Patching to Your End Users?
You might also like...
Automation

What the Head Nerds Were Up to in 2020

Security

January 2021 Patch Tuesday: One Actively Exploited Vulnerability and a Few Likely to Be

Security

December 2020 Patch Tuesday—A quiet(er) finish to a busy year in vulnerabilities

Security

National Computer Security Day—It’s Not Just About the Computer Anymore

Security

November 2020 Patch Tuesday Update: 111 CVE Numbers Addressed

Security

US-CERT Releases Warning to Healthcare Organizations about Elevated Ransomware Risks

Want to stay up to date?

Get the latest MSP tips, tricks, and ideas sent to your inbox each week.

Loading form....

If the form does not load in a few seconds, it is probably because your browser is using Tracking Protection. This is either an Ad Blocker plug-in or your browser is in private mode. Please allow tracking on this page to request a subscription.

Note: Firefox users may see a shield icon to the left of the URL in the address bar. Click on this to disable tracking protection for this session/site

Recent Posts
  • What the Head Nerds Were Up to in 2020
  • RMM and PSA Tools: How to Make the Most of Both
  • How to Empower an IT Help Desk Team for Success
  • Six Tips That Will Make Managing Your MSP Company Easier
  • January 2021 Patch Tuesday: One Actively Exploited Vulnerability and a Few Likely to Be
Categories:
  • Security (230)
  • Tips & Advice (122)
  • Best Practices (94)
  • Managed Services (86)
  • Backup & Disaster Recovery (83)
  • The Head Nerds (75)
  • Business Growth (75)
  • IT Support (42)
  • Business (39)
  • Automation (37)
  • Cybersecurity (37)
  • Operations (34)
  • Mail (33)
  • Remote Management (28)
  • ITSM (25)
  • Cloud Computing (21)
  • Networking (21)
  • Data (21)
  • Marketing (14)
  • Product (11)
  • PSA (11)
  • Service Desk (5)
  • Services & Support (5)
  • Mobile (4)
  • Risk Intelligence (4)
  • Customer Service (3)
  • Internet of Things (3)
  • Research & Trends (2)
  • Training (2)
  • GDPR (2)
  • Business Risk (1)
  • LOGICcards (1)
Show moreless
SolarWinds MSP

Products
  • SolarWinds RMM
  • SolarWinds N-central
  • SolarWinds Backup
  • SolarWinds EDR
  • SolarWinds MSP Manager
  • SolarWinds Mail Assure
  • SolarWinds Risk Intelligence
  • SolarWinds Take Control
  • SolarWinds Passportal
  • All Products Use Cases
Solutions
  • Security Solutions
  • Monitoring Solutions
  • Efficiency Solutions
  • Identify which RMM solution is right for me
  • Drive Efficiency with Automation
  • Manage my MSP Business More Efficiently
  • Manage my IT Department More Efficiently
  • Layered Security
  • Cross-Platform Support
  • Data-Driven Insights
About
  • About Us
  • Careers
  • Newsroom
  • Leadership Team
  • Upcoming Events
  • Subscription Preferences
  • SolarWinds
  • SolarWinds Trust Center
  • COVID-19 Response
Support
  • SolarWinds RMM
  • Solarwinds N-central
  • SolarWinds Backup
  • SolarWinds Mail Assure
  • SolarWinds Take Control
  • SolarWinds MSP Manager
  • Solarwinds Risk Intelligence
  • Solarwinds Threat Monitor
  • SolarWinds Passportal
  • SolarWinds Take Control Downloads
  • Backup & Recovery Downloads
  • Service Status

Footer 2

  • Legal Documents
  • Privacy
  • California Privacy Rights
  • Security Information
  • Sitemap

© SolarWinds MSP Canada ULC and SolarWinds MSP UK Ltd.
All Rights Reserved.