Maximilian Leire
Maximilian Leire Max started working for Ordina in 2019 as a security consultant, his preferred cyber security domains are cloud security and vulnerability management. He is the co-developer of this blog.

Microsoft Security Update August 2020

Microsoft Security Update August 2020

This Patch Tuesday provides fixes for 120 vulnerabilities of which 17 are classified as critical and 103 as important. The update also provides a fix for 2 zero-day vulnerabilities that are currently being used in active attacks.

This is the third largest monthly security patch Microsoft has ever released which puts this month in the top three largest Patch Tuesday updates together with the past two months of June & July 2020. With this month’s patch we exceeded the total amount of CVE’s disclosed in all of 2019 which had 851 CVE’s disclosed over the duration of the whole year.

Two exploits currently being used to perform attacks

  1. CVE-2020-1464 - Windows Spoofing Vulnerability
    The least dangerous of the two vulnerabilities is a spoofing vulnerability which allows bypassing signature verification of executable files. This means attackers could mask malicious software as official software made by legitimate companies. Patch as soon as possible to prevent falling victim to a malware attack.

  2. CVE-2020-1380 - Scripting Engine Memory Corruption Vulnerability
    The second vulnerability currently being exploited is the most dangerous of all CVE’s disclosed this month. By making a user visit a specifically crafted website using internet explorer (by using phishing via email for example) an attacker is able to execute any piece of (malicious) code they want on the target’s pc. Evidently this should be resolved as soon as possible to prevent compromise of your company’s network. If possible, stop using Internet Explorer.

If you need any assistance or have any questions regarding digital security of your company, don’t hesitate to contact our head of security.

Up until now a total of 862 CVE’s have been disclosed by Microsoft this year, compared to a total of 851 for all of 2019.

Technical terms:
A Zero-day: A vulnerability that was previously unknown to the public.
CVE: A list of entries — each containing an identification number, a description, and at least one public reference — for publicly known cybersecurity vulnerabilities.

Sources: