Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 120 vulnerabilities that were fixed in 13 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 13 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Internet Explorer Security Update for July 2020

  Severity

  Critical 4

  Qualys ID

  100408

  Vendor Reference

  KB4558998, KB4565479, KB4565483, KB4565489, KB4565503, KB4565508, KB4565511, KB4565513, KB4565524, KB4565536, KB4565537, KB4565541

  CVE Reference

  CVE-2020-1403, CVE-2020-1432

  CVSS Scores

  Base 7.6 / Temporal 5.6

  Description

  Microsoft releases the security update for Internet Explorer July 2020

  The KB Articles associated with the update:
  KB4565479
  KB4565537
  KB4565513
  KB4565489
  KB4565508
  KB4565511
  KB4565503
  KB4565524
  KB4565483
  KB4565541
  KB4565536
  KB4558998
  

  This QID checks for the file version of Mshtml.dll

  The following versions of Mshtml.dll with their corresponding KBs are verified:
  KB4565479 - 9.0.8112.21461 , 11.0.9600.19750
  KB4565537 - 11.0.9600.19750
  KB4565513 - 11.0.10240.18638
  KB4565489 - 11.0.17134.1610
  KB4565508 - 11.0.16299.1992
  KB4565511 - 11.0.14393.3808
  KB4565503 - 11.0.19041.388
  KB4565524 - 11.0.9600.19750
  KB4565483 - 11.0.18362.959
  KB4565541 - 11.0.9600.19750
  KB4565536 - 9.0.8112.21461
  KB4558998 - 11.0.17763.1339
  

  Consequence

  An attacker who successfully exploited the vulnerability could gain the same user rights as the current user.

  Solution

  Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Update Guide Windows

• Microsoft SharePoint Foundation and SharePoint Server Update July 2020

  Severity

  Urgent 5

  Qualys ID

  110354

  Vendor Reference

  KB4484353, KB4484370, KB4484374, KB4484411, KB4484436, KB4484440, KB4484443, KB4484448, KB4484451, KB4484453

  CVE Reference

  CVE-2020-1025, CVE-2020-1147, CVE-2020-1342, CVE-2020-1439, CVE-2020-1443, CVE-2020-1444, CVE-2020-1445, CVE-2020-1446, CVE-2020-1447, CVE-2020-1448, CVE-2020-1450, CVE-2020-1451, CVE-2020-1454, CVE-2020-1456

  CVSS Scores

  Base 7.5 / Temporal 6.2

  Description

  Microsoft has released July 2020 security updates to fix multiple security vulnerabilities.

  This security update contains the following KBs:

  KB4484443
  KB4484453
  KB4484448
  KB4484451
  KB4484436
  KB4484370
  KB4484440
  KB4484374
  KB4484411
  KB4484353

  QID Detection Logic:
  This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected SharePoint system.

  Consequence

  Successful exploitation allows an attacker to execute code remotely.

  Solution

  Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft SharePoint Foundation and SharePoint Server July 2020

• Microsoft Office and Microsoft Office Services and Web Apps Security Update July 2020

  Severity

  Critical 4

  Qualys ID

  110355

  Vendor Reference

  KB4484357, KB4484363, KB4484381, KB4484382, KB4484433, KB4484438, KB4484441, KB4484446, KB4484450, KB4484451, KB4484456, KB4484458, KB4484463

  CVE Reference

  CVE-2020-1240, CVE-2020-1342, CVE-2020-1349, CVE-2020-1409, CVE-2020-1442, CVE-2020-1445, CVE-2020-1446, CVE-2020-1447, CVE-2020-1448, CVE-2020-1449, CVE-2020-1458

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  Microsoft has released July 2020 security updates to fix multiple security vulnerabilities.

  This security update contains the following KBs:
  KB4484357
  KB4484451
  KB4484458
  KB4484446
  KB4484463
  KB4484441
  KB4484450
  KB4484363
  KB4484456
  KB4484438
  KB4484433
  KB4484381
  KB4484382

  QID Detection Logic:
  This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.

  Consequence

  Successful exploitation allows an attacker to execute code remotely.

  Solution

  Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Office and Microsoft Office Services and Web Apps Security Update JUNE 2020

• Microsoft Skype for Business Server Security and Lync Server Update for July 2020

  Severity

  Critical 4

  Qualys ID

  110356

  Vendor Reference

  KB4571334

  CVE Reference

  CVE-2020-1025

  CVSS Scores

  Base 7.5 / Temporal 5.5

  Description

  An elevation of privilege vulnerability exists when Skype for Business Server improperly handles OAuth token validation. To exploit this vulnerability, an attacker would need to modify the token.

  The update addresses the vulnerability by modifying how Microsoft Skype for Business Server validate tokens.

  Affected Software:
  Microsoft Lync Server 2013

  KB articles: 4571334

  QID Detection Logic:
  This authenticated QID detects vulnerable Lync Server 2013 Web Component by checking Microsoft.Rtc.Server.WebInfrastructure.dll file versions lesser than 5.0.8308.1134 from:
  \Microsoft.NET\assembly\GAC_32\Microsoft.Rtc.Server.WebInfrastructure.0_5.0.0.0*
  \Microsoft.NET\assembly\GAC_64\Microsoft.Rtc.Server.WebInfrastructure.0_5.0.0.0*
  

  Consequence

  Successful exploitation allows a remote attacker to bypass authentication and achieve improper access.

  Solution

  Customers are advised to refer to CVE-2020-1025 for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Skype for Business Server 2015 CU8
  Skype for Business Server 2019 CU2

• Microsoft OneDrive Update for July 2020

  Severity

  Serious 3

  Qualys ID

  110357

  Vendor Reference

  CVE-2020-1465

  CVE Reference

  CVE-2020-1465

  CVSS Scores

  Base 7.2 / Temporal 5.3

  Description

  An elevation of privilege vulnerability exists in Microsoft OneDrive that allows file deletion in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the system.

  The update addresses the vulnerability by correcting how Microsoft OneDrive handles file operations.

  Affected Software:
  OneDrive for Windows versions prior to 20.114.0607.0002 for all rings

  QID Detection Logic:
  This QID detects vulnerable versions of OneDrive by checking file version of OneDrive.exe

  NOTE: Only per machine installation (System wide installation) of OneDrive are affected.

  Consequence

  An attacker could run a specially crafted application that could exploit the vulnerability and take control of an affected system.

  Solution

  Customers are advised to refer to CVE-2020-1465 for more information pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  OneDrive for Windows

• Microsoft KB4569509 Mitigation Guidance for DNS Server Applied (CVE-2020-1350)

  Severity

  Minimal 1

  Qualys ID

  45451

  Vendor Reference

  N/A

  CVE Reference

  N/A

  CVSS Scores

  Base / Temporal

  Description

  Mitigation for "CVE-2020-1350 Windows DNS Server Remote Code Execution Vulnerability" is applied on the host.

  QID Detection Logic (Authenticated):
  

  This QID checks for Windows registry key "HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters", posts this QID when value "TcpReceivePacketSize" is 65280(0xFF00)

  Consequence

  N/A

  Solution

  Please refer to the KB4569509: Guidance for DNS Server Vulnerability CVE-2020-1350 for more information

• Microsoft Windows Security Update for July 2020

  Severity

  Urgent 5

  Qualys ID

  91653

  Vendor Reference

  KB4558998, KB4565483, KB4565489, KB4565503, KB4565508, KB4565511, KB4565513, KB4565524, KB4565529, KB4565535, KB4565536, KB4565537, KB4565539, KB4565540, KB4565541, KB5011570, KB5011649, KB5012672, KB5013270, KB5014026, KB5014027

  CVE Reference

  CVE-2020-1032, CVE-2020-1036, CVE-2020-1040, CVE-2020-1041, CVE-2020-1042, CVE-2020-1043, CVE-2020-1085, CVE-2020-1249, CVE-2020-1267, CVE-2020-1330, CVE-2020-1333, CVE-2020-1336, CVE-2020-1344, CVE-2020-1346, CVE-2020-1347, CVE-2020-1351, CVE-2020-1352, CVE-2020-1353, CVE-2020-1354, CVE-2020-1355, CVE-2020-1356, CVE-2020-1357, CVE-2020-1358, CVE-2020-1359, CVE-2020-1360, CVE-2020-1361, CVE-2020-1362, CVE-2020-1363, CVE-2020-1364, CVE-2020-1365, CVE-2020-1366, CVE-2020-1367, CVE-2020-1368, CVE-2020-1369, CVE-2020-1370, CVE-2020-1371, CVE-2020-1372, CVE-2020-1373, CVE-2020-1374, CVE-2020-1375, CVE-2020-1381, CVE-2020-1382, CVE-2020-1384, CVE-2020-1385, CVE-2020-1386, CVE-2020-1387, CVE-2020-1388, CVE-2020-1389, CVE-2020-1390, CVE-2020-1391, CVE-2020-1392, CVE-2020-1393, CVE-2020-1394, CVE-2020-1395, CVE-2020-1396, CVE-2020-1397, CVE-2020-1398, CVE-2020-1399, CVE-2020-1400, CVE-2020-1401, CVE-2020-1402, CVE-2020-1404, CVE-2020-1405, CVE-2020-1406, CVE-2020-1407, CVE-2020-1408, CVE-2020-1409, CVE-2020-1410, CVE-2020-1411, CVE-2020-1412, CVE-2020-1413, CVE-2020-1414, CVE-2020-1415, CVE-2020-1418, CVE-2020-1419, CVE-2020-1420, CVE-2020-1421, CVE-2020-1422, CVE-2020-1423, CVE-2020-1424, CVE-2020-1426, CVE-2020-1427, CVE-2020-1428, CVE-2020-1429, CVE-2020-1430, CVE-2020-1431, CVE-2020-1434, CVE-2020-1435, CVE-2020-1436, CVE-2020-1437, CVE-2020-1438, CVE-2020-1463, CVE-2020-1468

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft releases the security update for Windows July 2020

  The KB Articles associated with the update:
  KB4558998
  KB4565483
  KB4565489
  KB4565503
  KB4565508
  KB4565511
  KB4565513
  KB4565524
  KB4565529
  KB4565535
  KB4565536
  KB4565537
  KB4565539
  KB4565540
  KB4565541
  

  QID Detection Logic (Authenticated):
  

  This QID checks for the file version of ntoskrnl.exe

  The following versions of ntoskrnl.exe with their corresponding KBs are verified:
  KB4565489 - 10.0.17134.1610
  KB4565524 - 6.1.7601.24557
  KB4558998 - 10.0.17763.1339
  KB4565539 - 6.1.7601.24557
  KB4565537 - 6.2.9200.23084
  KB4565511 - 10.0.14393.3808
  KB4565535 - 6.2.9200.23084
  KB4565529 - 6.0.6003.20881
  KB4565483 - 10.0.18362.959
  KB4565541 - 6.3.9600.19761
  KB4565540 - 6.3.9600.19761
  KB4565508 - 10.0.16299.1992
  KB4565536 - 6.0.6003.20881
  KB4565513 - 10.0.10240.18638
  

  Consequence

  An attacker who successfully exploited this vulnerability could take control of the affected system

  Solution

  Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Update Guide Windows

• Microsoft Windows Servicing Stack Security Update July 2020

  Severity

  Serious 3

  Qualys ID

  91655

  Vendor Reference

  ADV990001

  CVE Reference

  N/A

  CVSS Scores

  Base 6.8 / Temporal 5

  Description

  Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes.

  Microsoft has released Servicing Stack security updates for Windows 8.1, Windows 7, Windows 10,Windows Server 2008,Windows Server 2012,Windows Server 2016,Windows Server 2019.

  QID Detection Logic (Authenticated):
  This authenticated QID will check for file version of CbsCore.dll

  Consequence

  Successful exploitation may allow unauthorized disclosure of information, unauthorized modification or disruption of service.

  Solution

  Customers are advised to refer to advisory ADV990001 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  ADV990001

• Microsoft Edge Security Update for July 2020

  Severity

  Critical 4

  Qualys ID

  91656

  Vendor Reference

  KB4558998, KB4565483, KB4565489, KB4565503, KB4565508, KB4565511, KB4565513

  CVE Reference

  CVE-2020-1433, CVE-2020-1462

  CVSS Scores

  Base 4.3 / Temporal 3.2

  Description

  Microsoft releases the security update for Microsoft Edge July 2020

  The KB Articles associated with the update:
  KB4558998
  KB4565483
  KB4565489
  KB4565503
  KB4565508
  KB4565511
  KB4565513
  

  QID Detection Logic:Authenticated
  This QID checks for the file version of edgehtml.dll

  Consequence

  On successfull exploitation,an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Please refer to the CVE-2020-1433 for more information pertaining to these vulnerabilities.

  Please refer to the CVE-2020-1462 for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-1433
  CVE-2020-1462

• Microsoft Visual Studio Security Update for July 2020

  Severity

  Critical 4

  Qualys ID

  91657

  Vendor Reference

  CVE-2020-1147, CVE-2020-1393, CVE-2020-1416

  CVE Reference

  CVE-2020-1147, CVE-2020-1393, CVE-2020-1416

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  Microsoft has released security update for Visual Studio which resolves multiple security vulnerabilities.

  Affected Software:
  Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
  Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
  Microsoft Visual Studio 2019 version 16.6 (includes 16.0 - 16.5)
  Microsoft Visual Studio 2019 version 16.0
  Microsoft Visual Studio 2015 Update 3

  QID Detection Logic: Authenticated
  This QID detects vulnerable versions of Microsoft Visual Studio by checking file version of devenv.exe.

  NOTE: Microsoft Visual Studio 2015 Update 3 is only prone to CVE-2020-1393.

  Consequence

  Successful exploitation can affect confidentiality, integrity and availability.

  Solution

  Customers are advised to refer to CVE-2020-1393 CVE-2020-1416 CVE-2020-1147 for more information pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-1147 Windows
  CVE-2020-1393 Windows
  CVE-2020-1416 Windows

• Microsoft .NET Framework And .NET Core Security Updates for July 2020

  Severity

  Critical 4

  Qualys ID

  91658

  Vendor Reference

  .NET Core July 2020, KB4565489, KB4565508, KB4565627, KB4565628, KB4565630, KB4565631, KB4565633, KB4566466, KB4566467, KB4566468, KB4566469, KB4566516, KB4566517, KB4566518, KB4566519, KB4566520

  CVE Reference

  CVE-2020-1147

  CVSS Scores

  Base 6.8 / Temporal 5.3

  Description

  A remote code execution vulnerability exists in .NET Framework and .NET Core when the software fails to check the source markup of XML file input.

  KB4565489,KB4565508,KB4565627,KB4565628,KB4565630,KB4565631,KB4565633,KB4566466,KB4566467,KB4566468,KB4566469,KB4566516,KB4566517,KB4566518,KB4566519,KB4566520 kbs and .Net Core are covered. This security update is rated Critical for supported versions of Microsoft .NET Framework and .NET Core.

  .NET Framework 2.0, 3.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 and 4.8
  Any .NET Core 2.1 application running on .NET Core 2.1.19 or lower
  .Any .NET Core 3.1 application running on .NET Core 3.1.5 or lower
  Any .NET 5 application running on .NET 5 Preview 6 or lower

  QID Detection Logic (Authenticated):
  - Checks for vulnerable version of System.data.dll for .Net Framework
  - Checks for sub directories under %programfiles%\dotnet\shared\Microsoft.NETCore.App, %programfiles(x86)%\dotnet\shared\Microsoft.NETCore.App and checks for vulnerable versions in .version file on windows.

  Consequence

  An attacker who successfully exploited the vulnerability can run arbitrary code in the context of the process responsible for deserialization of the XML content.

  Solution

  Customers are advised to refer to CVE-2020-1147 for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-1147

• Microsoft Defender Elevation of Privilege Vulnerability July 2020

  Severity

  Serious 3

  Qualys ID

  91660

  Vendor Reference

  CVE-2020-1461

  CVE Reference

  CVE-2020-1461

  CVSS Scores

  Base 3.6 / Temporal 2.7

  Description

  An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.

  Affected Software:
  Microsoft Forefront Endpoint Protection 2010
  Microsoft Security Essentials
  Microsoft System Center 2012 Endpoint Protection
  Microsoft System Center 2012 R2 Endpoint Protection
  Microsoft System Center Endpoint Protection
  Windows Defender

  QID Detection Logic (Authenticated):
  The authenticated check looks for vulnerable version of file C:\WINDOWS\System32\MpSigStub.exe MpSigStub.exe.

  Consequence

  Successful exploitation allows attacker to delete arbitrary files on the system.

  Solution

  Users are advised to check CVE-2020-1461 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-1461

• Microsoft Windows DNS Server Remote Code Execution Vulnerability (CVE-2020-1350)(SIGRed)

  Severity

  Urgent 5

  Qualys ID

  91662

  Vendor Reference

  CVE-2020-1350

  CVE Reference

  CVE-2020-1350

  CVSS Scores

  Base 10 / Temporal 8.3

  Description

  A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests. The KB Articles associated with the update:
  KB4565537
  KB4565511
  KB4565503
  KB4565535
  KB4565483
  KB4565524
  KB4565536
  KB4558998
  KB4565541
  KB4565539
  KB4565529
  KB4565540
  

  QID Detection Logic (Authenticated):
  This QID checks for the file version of dns.exe.
  NOTE: Detection is not checking for workaround, as long as device is missing the patch regardless of workaround mitigation status, this QID will flag.

  QID Detection Logic (Unauthenticated):
  This QID compares the self-reported DNS banner version with patched versions to detect if the patch is installed
  

  The following versions of dns.exe with their corresponding KBs are verified:
  KB4565537 - 6.2.9200.23084
  KB4565511 - 10.0.14393.3808
  KB4565535 - 6.2.9200.23084
  KB4565524 - 6.1.7601.24557
  KB4565536 - 6.0.6003.20885
  KB4565541 - 6.3.9600.19759
  KB4565539 - 6.1.7601.24557
  KB4565529 - 6.0.6003.20885
  KB4565540 - 6.3.9600.19759
  

  Consequence

  An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account.

  Solution

  Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Update Guide Windows(DNS)

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.