➠ The May 2020 Security Update Review

May is upon us, and with it brings another bumper crop of security patches from Adobe and Microsoft. Take a break from your regularly scheduled activities and join us as we review the details for security patches for this month.

Adobe Patches for May 2020

The Adobe updates for May are just two patches covering 36 CVEs. Two of these CVEs were reported through the ZDI program. The patch for Adobe Acrobat and Reader covers 24 Critical and Important-rated CVEs that mostly consist of Out-of-Bounds (OOB) Reads and Writes. There are also some buffer overflows, memory corruptions, stack exhaustion, and Use-After-Free (UAF) bugs fixed. The patch for the Adobe DNG Software Development Kit (SDK) fixes four Critical-rated heap overflows and eight Important-rated OOB Reads. The overflows could lead to code execution, so if you use the DNG format for your digital photography, definitely make sure you are patched. None of these bugs are listed as publicly known or under active attack at the time of release.

Microsoft Patches for May 2020

For May, Microsoft released patches for 111 CVEs covering Microsoft Windows, Microsoft Edge (EdgeHTML-based), ChakraCore, Internet Explorer, Microsoft Office, and Microsoft Office Services and Web Apps, Visual Studio, Microsoft Dynamics, .NET Framework, .NET Core, and Power BI. Of these 111 CVEs, 16 are rated Critical and 95 are rated Important in severity. Eleven of these CVEs were reported through the ZDI program. None of the bugs being patched are listed as being publicly known or under active attack at the time of release. That makes three months in a row that Microsoft has released patches for more than 110 CVEs. We’ll see if they maintain that pace throughout the year.

Let’s take a closer look at some of the more interesting updates for this month, starting with a bug that requires physical access:

-       CVE-2020-1071 – Windows Remote Access Common Dialog Elevation of Privilege Vulnerability
Law #3 of the 10 Immutable Laws of Security states, “If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore.” But what if the physical access is something other than unrestricted? That seems to be the case here. An attacker would need to be at the system and boot it to the login screen. If they can do that, they could leverage a bug in the Remote Access Common Dialog to run arbitrary code with elevated privileges. This bug will be much more critical for places with open offices where casual physical access is common.

 -       CVE-2020-1135 - Windows Graphics Component Elevation of Privilege Vulnerability
While Pwn2Own may have been virtual this year, the bugs demonstrated certainly were not. This bug from the Fluoroacetate duo of Richard Zhu and Amat Cama allows a logged-on user to take over a system by running a specially crafted program. They leveraged a Use-After-Free (UAF) bug in Windows to escalate from a regular user to SYSTEM.

-       CVE-2020-1067 - Windows Remote Code Execution Vulnerability
This patch corrects an RCE bug in the Windows OS that could allow an attacker to execute arbitrary code with elevated permissions on affected systems. The only thing keeping this from being Critical is the fact that the attacker needs a domain user account for their specially crafted request to succeed. This makes the bug a prime target for insider threats, as well as penetration testers looking to expand their foothold in a target enterprise.

-       CVE-2020-1118 - Microsoft Windows Transport Layer Security Denial of Service Vulnerability
This patch addresses a bug that allows a remote, unauthenticated attacker to abnormally reboot, resulting in a denial-of-service condition. A NULL pointer dereference vulnerability exists in the Windows implementation of the Diffie-Hellman protocol. An attacker can exploit this vulnerability by sending a malicious Client Key Exchange message during a TLS handshake. The vulnerability affects both TLS clients and TLS servers, so just about any system could be shut down by an attacker. Either way, successful exploitation will cause the lsass.exe process to terminate.

 Here’s the full list of CVEs released by Microsoft for May 2020.