Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 124 vulnerabilities that were fixed in 9 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 9 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Windows Adobe Flash Player Security Update for June 2020 (ADV200010)

  Severity

  Critical 4

  Qualys ID

  100406

  Vendor Reference

  ADV200010

  CVE Reference

  CVE-2020-9633

  CVSS Scores

  Base 10 / Temporal 7.4

  Description

  The update contains security fixes for Adobe Flash Player on Internet Explorer.

  Affected Versions:
  Windows 10, version 2004,Windows 10, version 1903 and 1909,Windows 10, version 1809 and Windows Server 2019,Windows 10, version 1803,Windows 10, version 1709,Windows 10, version 1703,Windows 10, version 1607 and Windows Server 2016,Windows 10 (initial version released July 2015),Windows 8.1, Windows RT 8.1 and Windows Server 2012 R2,Windows Server 2012 with Adobe Flash Player version prior to N/A.

  QID Detection Logic:
  This authenticated QID will flag if file version of %windir%\System32\Macromed\Flash\Flash.ocx is less than 32.0.0.387.

  Consequence

  An attacker could exploit this vulnerability to compromise Confidentiality, Integrity and/or Availability.

  Solution

  Customers are advised to follow 4561600 for instructions pertaining to the remediation of this vulnerability.

  Workaround:
  1. Prevent Adobe Flash Player from running You can disable attempts to instantiate Adobe Flash Player in Internet Explorer and other applications that honor the kill bit feature, such as Office 2007 and Office 2010, by setting the kill bit for the control in the registry.
  2. Windows Registry Editor Version 5.00
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
  "Compatibility Flags"=dword:00000400

  3. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
  "Compatibility Flags"=dword:00000400
  Double-click the .reg file to apply it to an individual system.
  You can also apply this workaround across domains by using Group Policy. For more information about Group Policy, see the TechNet article, Group Policy collection.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  ADV200010

• Microsoft Internet Explorer Security Update for June 2020

  Severity

  Critical 4

  Qualys ID

  100407

  Vendor Reference

  KB4557957, KB4560960, KB4561602, KB4561603, KB4561608, KB4561612, KB4561616, KB4561621, KB4561643, KB4561649, KB4561666, KB4561670

  CVE Reference

  CVE-2020-1213, CVE-2020-1214, CVE-2020-1215, CVE-2020-1216, CVE-2020-1219, CVE-2020-1230, CVE-2020-1260, CVE-2020-1315

  CVSS Scores

  Base 7.6 / Temporal 6.3

  Description

  Microsoft releases the security update for Internet Explorer June 2020

  The KB Articles associated with the update:
  KB4561602
  KB4561643
  KB4557957
  KB4560960
  KB4561649
  KB4561608
  KB4561612
  KB4561666
  KB4561603
  KB4561670
  KB4561621
  KB4561616
  

  This QID checks for the file version of Mshtml.dll

  The following versions of Mshtml.dll with their corresponding KBs are verified:
  KB4561602 - 11.0.16299.1932
  KB4561643 - 11.0.9600.19724
  KB4557957 - 11.0.19041.329
  KB4560960 - 11.0.18362.900
  KB4561649 - 11.0.10240.18608
  KB4561608 - 11.0.17763.1282
  KB4561612 - 10.0.9200.22975 , 11.0.9600.19724
  KB4561666 - 11.0.9600.19724
  KB4561603 - 11.0.9600.19724 , 9.0.8112.21452
  KB4561670 - 9.0.8112.21452
  KB4561621 - 11.0.17134.1550
  KB4561616 - 11.0.14393.3750
  

  Consequence

  An attacker who successfully exploited the vulnerability could gain the same user rights as the current user.

  Solution

  Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Update Guide Windows

• Microsoft SharePoint Foundation and SharePoint Server Update June 2020

  Severity

  Critical 4

  Qualys ID

  110351

  Vendor Reference

  KB4484391, KB4484400, KB4484402, KB4484405, KB4484409, KB4484414

  CVE Reference

  CVE-2020-1148, CVE-2020-1177, CVE-2020-1178, CVE-2020-1181, CVE-2020-1183, CVE-2020-1289, CVE-2020-1295, CVE-2020-1297, CVE-2020-1298, CVE-2020-1318, CVE-2020-1320, CVE-2020-1323

  CVSS Scores

  Base 6.5 / Temporal 5.1

  Description

  Microsoft has released June 2020 security updates to fix multiple security vulnerabilities.

  This security update contains the following KBs:

  KB4484402
  KB4484405
  KB4484414
  KB4484400
  KB4484391
  KB4484409

  QID Detection Logic:
  This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.

  Consequence

  Successful exploitation allows an attacker to execute code remotely.

  Solution

  Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft SharePoint Foundation and SharePoint Server June 2020

• Microsoft Office and Microsoft Office Services and Web Apps Security Update June 2020

  Severity

  Critical 4

  Qualys ID

  110352

  Vendor Reference

  KB4484342, KB4484351, KB4484361, KB4484369, KB4484373, KB4484378, KB4484380, KB4484387, KB4484396, KB4484399, KB4484403, KB4484410, KB4484415

  CVE Reference

  CVE-2020-1225, CVE-2020-1226, CVE-2020-1229, CVE-2020-1321, CVE-2020-1322

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  Microsoft has released June 2020 security updates to fix multiple security vulnerabilities.

  This security update contains the following KBs:
  KB4484403
  KB4484415
  KB4484410
  KB4484342
  KB4484396
  KB4484373
  KB4484378
  KB4484351
  KB4484380
  KB4484361
  KB4484369
  KB4484399
  KB4484387

  QID Detection Logic:
  This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.

  Consequence

  Successful exploitation allows an attacker to execute code remotely.

  Solution

  Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Office and Microsoft Office Services and Web Apps Security Update JUNE 2020

• Microsoft Windows Servicing Stack Security Update June 2020

  Severity

  Serious 3

  Qualys ID

  91643

  Vendor Reference

  ADV990001

  CVE Reference

  N/A

  CVSS Scores

  Base 6.8 / Temporal 5

  Description

  Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes.

  Microsoft has released Servicing Stack security updates for Windows 2008, Windows 7, Windows 2008 R2.

  QID Detection Logic (Authenticated):
  This authenticated QID will check for file version of CbsCore.dll

  Consequence

  Successful exploitation may allow unauthorized disclosure of information, unauthorized modification or disruption of service.

  Solution

  Customers are advised to refer to advisory ADV990001 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  ADV990001

• Microsoft Edge Security Update for June 2020

  Severity

  Critical 4

  Qualys ID

  91645

  Vendor Reference

  ,CVE-2020-1195, ,CVE-2020-1219, CVE-2020-1073, CVE-2020-1242

  CVE Reference

  CVE-2020-1073, CVE-2020-1195, CVE-2020-1219, CVE-2020-1220, CVE-2020-1242

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft releases the security update for Microsoft Edge June 2020

  The KB Articles associated with the update:
  KB4557957
  KB4560960
  KB4561602
  KB4561608
  KB4561616
  KB4561621
  KB4561649
  

  QID Detection Logic:Authenticated
  This QID checks for the file version of edgehtml.dll

  Consequence

  On successfull exploitation,an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Please refer to the CVE-2020-1242 for more information pertaining to these vulnerabilities.

  Please refer to the CVE-2020-1073 for more information pertaining to these vulnerabilities.

  Please refer to the CVE-2020-1195 for more information pertaining to these vulnerabilities.

  Please refer to the CVE-2020-1219 for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-1073
  CVE-2020-1195
  CVE-2020-1219
  CVE-2020-1242

• Microsoft Windows Security Update for June 2020

  Severity

  Urgent 5

  Qualys ID

  91646

  Vendor Reference

  KB4560960, KB4561602, KB4561608, KB4561612, KB4561616, KB4561621, KB4561643, KB4561645, KB4561649, KB4561666, KB4561669, KB4561670, KB4561673, KB4561674

  CVE Reference

  CVE-2020-0915, CVE-2020-0916, CVE-2020-0986, CVE-2020-1120, CVE-2020-1160, CVE-2020-1162, CVE-2020-1194, CVE-2020-1196, CVE-2020-1197, CVE-2020-1199, CVE-2020-1201, CVE-2020-1202, CVE-2020-1203, CVE-2020-1204, CVE-2020-1207, CVE-2020-1208, CVE-2020-1209, CVE-2020-1211, CVE-2020-1212, CVE-2020-1213, CVE-2020-1214, CVE-2020-1215, CVE-2020-1216, CVE-2020-1217, CVE-2020-1222, CVE-2020-1230, CVE-2020-1231, CVE-2020-1232, CVE-2020-1233, CVE-2020-1234, CVE-2020-1235, CVE-2020-1236, CVE-2020-1237, CVE-2020-1238, CVE-2020-1239, CVE-2020-1241, CVE-2020-1244, CVE-2020-1246, CVE-2020-1247, CVE-2020-1248, CVE-2020-1251, CVE-2020-1253, CVE-2020-1254, CVE-2020-1255, CVE-2020-1257, CVE-2020-1258, CVE-2020-1259, CVE-2020-1260, CVE-2020-1261, CVE-2020-1262, CVE-2020-1263, CVE-2020-1264, CVE-2020-1265, CVE-2020-1266, CVE-2020-1268, CVE-2020-1269, CVE-2020-1270, CVE-2020-1271, CVE-2020-1272, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1277, CVE-2020-1278, CVE-2020-1279, CVE-2020-1280, CVE-2020-1281, CVE-2020-1282, CVE-2020-1283, CVE-2020-1286, CVE-2020-1287, CVE-2020-1290, CVE-2020-1291, CVE-2020-1292, CVE-2020-1293, CVE-2020-1294, CVE-2020-1296, CVE-2020-1299, CVE-2020-1300, CVE-2020-1301, CVE-2020-1302, CVE-2020-1304, CVE-2020-1305, CVE-2020-1306, CVE-2020-1307, CVE-2020-1309, CVE-2020-1310, CVE-2020-1311, CVE-2020-1312, CVE-2020-1313, CVE-2020-1314, CVE-2020-1315, CVE-2020-1316, CVE-2020-1317, CVE-2020-1324, CVE-2020-1334, CVE-2020-1348, CVE-2020-1441

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft releases the security update for Windows June 2020

  The KB Articles associated with the update:
  KB4561602
  KB4561670
  KB4561674
  KB4561643
  KB4561645
  KB4560960
  KB4561673
  KB4561608
  KB4561612
  KB4561666
  KB4561669
  KB4561649
  KB4561621
  KB4561616
  

  This QID checks for the file version of ntoskrnl.exe

  The following versions of ntoskrnl.exe with their corresponding KBs are verified:
  KB4561602 - 10.0.16299.1932
  KB4561670 - 6.0.6003.20851
  KB4561674 - 6.2.9200.23060
  KB4561643 - 6.1.7601.24556
  KB4561645 - 6.0.6003.20851
  KB4560960 - 10.0.18362.900
  KB4561673 - 6.3.9600.19724
  KB4561608 - 10.0.17763.1282
  KB4561612 - 6.2.9200.23060
  KB4561666 - 6.3.9600.19724
  KB4561669 - 6.1.7601.24556
  KB4561649 - 10.0.10240.18608
  KB4561621 - 10.0.17134.1550
  KB4561616 - 10.0.14393.3750
  

  Consequence

  An attacker could exploit the vulnerability to execute malicious code.

  Solution

  Please refer to the Security Update Guide for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Update Guide Windows

• Microsoft Visual Studio Security Update for June 2020

  Severity

  Critical 4

  Qualys ID

  91647

  Vendor Reference

  CVE-2020-1202, CVE-2020-1203, CVE-2020-1257, CVE-2020-1278, CVE-2020-1293

  CVE Reference

  CVE-2020-1202, CVE-2020-1203, CVE-2020-1257, CVE-2020-1278, CVE-2020-1293

  CVSS Scores

  Base 7.2 / Temporal 5.3

  Description

  Microsoft has released security update for Visual Studio which resolves multiple security vulnerabilities.

  Affected Software:
  Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
  Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
  Microsoft Visual Studio 2019 version 16.6 (includes 16.0 - 16.5)
  Microsoft Visual Studio 2019 version 16.0
  Microsoft Visual Studio 2015 Update 3

  QID Detection Logic:Authenticated
  This QID detects vulnerable versions of Microsoft Visual Studio by checking file version of devenv.exe.

  Consequence

  Successful exploitation can affect confidentiality, integrity and availability.

  Solution

  Customers are advised to refer to Advisory for more information pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-1202
  CVE-2020-1203
  CVE-2020-1257
  CVE-2020-1278
  CVE-2020-1293

• Microsoft Windows SMBv3 Client/Server Information Disclosure Vulnerability (SMBleed)

  Severity

  Critical 4

  Qualys ID

  91651

  Vendor Reference

  CVE-2020-1206

  CVE Reference

  CVE-2020-1206, CVE-2020-1284

  CVSS Scores

  Base 5 / Temporal 4.1

  Description

  Microsoft Windows is exposed to an information disclosure vulnerability. The vulnerability is in Microsoft Server Message Block 3.1.1 (SMBv3) protocol handling.

  Affected Software:
  Windows 10 Version 1903, Windows 10 Version 1909, Windows 10 Version 2004 and Windows Server, version 1903/1909/2004 (Server Core installation)

  QID Detection Logic (Authenticated):
  

  For SMB client side, this QID checks file version of "mrxsmb.sys"

  For SMB Server side, this QID checks if SMB and SMB Compression are enabled as well as file version of "srvnet.sys".

  Note: the file "srv2.sys" is not updated by the patch during our observation , this is why we are checking "srvnet.sys".

  Consequence

  An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system.

  Solution

  Users are advised to check CVE-2020-1206 for more information.

  Workaround:
  Disable SMBv3 compression You can disable compression to block unauthenticated attackers from exploiting the vulnerability against an SMBv3 Server with the PowerShell command below.

  Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2020-1206 Windows(SMBv3)

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.