Patch-Tuesday: Microsoft schließt 123 Schwachstellen

Zum regulären Patch-Tuesday schließt Microsoft in diesem Monat 123 Sicherheitslücken in 13 Produkten. Laut Microsoft wurde bislang keine der in diesem Monat behobenen Sicherheitslücken bislang ausgenutzt.

Der schwerwiegendste Fehler, der in diesem Monat gepatcht wurde, ist ein Fehler (CVE-2020-1350) in der Windows Server DNS-Komponente. Die von Check-Point-Forschern entdeckte Schwachstelle erhielt mit 10 von 10 möglichen Schweregraden die höchste Einstufung. Obwohl derzeit nichts über Angriffe bekannt ist, die diese wurmfähige Schwachstelle aktiv ausnutzen, geht Check Point davon aus, dass der Fehler in der Vergangenheit ausgenutzt worden sei. Schließlich sei der entsprechende Code seit 17 Jahren Teil von Windows Server.

Andere wichtige Fehler, die in diesem Monat gepatcht wurden, umfassen auch Sicherheitslücken, die aus der Ferne ausgenutzt werden können:

• RemoteFX vGPU-Komponente von Microsofts Hyper-V-Hypervisor-Technologie (CVE-2020-1041, CVE-2020-1040, CVE-2020-1032, CVE-2020-1036, CVE-2020-1042, CVE-2020-1043)
• Jet-Datenbankmodul ist in einigen Office-Anwendungen enthalten (CVE-2020-1400, CVE-2020-1401, CVE-2020-1407)
• Microsoft Word (CVE-2020-1446, CVE-2020-1447, CVE-2020-1448)
• Microsoft Excel (CVE-2020-1240)
• Microsoft Outlook (CVE-2020-1349)
• Microsoft Sharepoint (CVE-2020-1444)
• Windows-LNK-Verknüpfungsdateien (CVE-2020-1421)
• Verschiedene Windows-Grafikkomponenten (CVE-2020-1435, CVE-2020-1408, CVE-2020-1412, CVE-2020-1409, CVE-2020-1436, CVE-2020-1355)

Patch-Tuesday Juli 2020

Tag	CVE ID	CVE Title
Windows IIS	ADV200008	Microsoft Guidance for Enabling Request Smuggling Filter on IIS Servers
.NET Framework	CVE-2020-1147	.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability
Azure DevOps	CVE-2020-1326	Azure DevOps Server Cross-site Scripting Vulnerability
Internet Explorer	CVE-2020-1432	Skype for Business via Internet Explorer Information Disclosure Vulnerability
Microsoft Edge	CVE-2020-1433	Microsoft Edge PDF Information Disclosure Vulnerability
Microsoft Edge	CVE-2020-1462	Skype for Business via Microsoft Edge (EdgeHTML-based) Information Disclosure Vulnerability
Microsoft Graphics Component	CVE-2020-1355	Windows Font Driver Host Remote Code Execution Vulnerability
Microsoft Graphics Component	CVE-2020-1468	Windows GDI Information Disclosure Vulnerability
Microsoft Graphics Component	CVE-2020-1351	Microsoft Graphics Component Information Disclosure Vulnerability
Microsoft Graphics Component	CVE-2020-1436	Windows Font Library Remote Code Execution Vulnerability
Microsoft Graphics Component	CVE-2020-1435	GDI+ Remote Code Execution Vulnerability
Microsoft Graphics Component	CVE-2020-1412	Microsoft Graphics Components Remote Code Execution Vulnerability
Microsoft Graphics Component	CVE-2020-1409	DirectWrite Remote Code Execution Vulnerability
Microsoft Graphics Component	CVE-2020-1408	Microsoft Graphics Remote Code Execution Vulnerability
Microsoft Graphics Component	CVE-2020-1397	Windows Imaging Component Information Disclosure Vulnerability
Microsoft Graphics Component	CVE-2020-1381	Windows Graphics Component Elevation of Privilege Vulnerability
Microsoft Graphics Component	CVE-2020-1382	Windows Graphics Component Elevation of Privilege Vulnerability
Microsoft JET Database Engine	CVE-2020-1407	Jet Database Engine Remote Code Execution Vulnerability
Microsoft JET Database Engine	CVE-2020-1400	Jet Database Engine Remote Code Execution Vulnerability
Microsoft JET Database Engine	CVE-2020-1401	Jet Database Engine Remote Code Execution Vulnerability
Microsoft Malware Protection Engine	CVE-2020-1461	Microsoft Defender Elevation of Privilege Vulnerability
Microsoft Office	CVE-2020-1445	Microsoft Office Information Disclosure Vulnerability
Microsoft Office	CVE-2020-1446	Microsoft Word Remote Code Execution Vulnerability
Microsoft Office	CVE-2020-1349	Microsoft Outlook Remote Code Execution Vulnerability
Microsoft Office	CVE-2020-1439	PerformancePoint Services Remote Code Execution Vulnerability
Microsoft Office	CVE-2020-1240	Microsoft Excel Remote Code Execution Vulnerability
Microsoft Office	CVE-2020-1458	Microsoft Office Remote Code Execution Vulnerability
Microsoft Office	CVE-2020-1442	Office Web Apps XSS Vulnerability
Microsoft Office	CVE-2020-1449	Microsoft Project Remote Code Execution Vulnerability
Microsoft Office	CVE-2020-1447	Microsoft Word Remote Code Execution Vulnerability
Microsoft Office	CVE-2020-1448	Microsoft Word Remote Code Execution Vulnerability
Microsoft Office SharePoint	CVE-2020-1456	Microsoft Office SharePoint XSS Vulnerability
Microsoft Office SharePoint	CVE-2020-1454	Microsoft SharePoint Reflective XSS Vulnerability
Microsoft Office SharePoint	CVE-2020-1342	Microsoft Office Information Disclosure Vulnerability
Microsoft Office SharePoint	CVE-2020-1443	Microsoft SharePoint Spoofing Vulnerability
Microsoft Office SharePoint	CVE-2020-1450	Microsoft Office SharePoint XSS Vulnerability
Microsoft Office SharePoint	CVE-2020-1444	Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft Office SharePoint	CVE-2020-1451	Microsoft Office SharePoint XSS Vulnerability
Microsoft OneDrive	CVE-2020-1465	Microsoft OneDrive Elevation of Privilege Vulnerability
Microsoft Scripting Engine	CVE-2020-1403	VBScript Remote Code Execution Vulnerability
Microsoft Windows	CVE-2020-1406	Windows Network List Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1410	Windows Address Book Remote Code Execution Vulnerability
Microsoft Windows	CVE-2020-1085	Windows Function Discovery Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1402	Windows ActiveX Installer Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1330	Windows Mobile Device Management Diagnostics Information Disclosure Vulnerability
Microsoft Windows	CVE-2020-1431	Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1405	Windows Mobile Device Management Diagnostics Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1404	Windows Runtime Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1438	Windows Network Connections Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1430	Windows UPnP Device Host Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1429	Windows Error Reporting Manager Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1463	Windows SharedStream Library Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1437	Windows Network Location Awareness Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1434	Windows Sync Host Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1427	Windows Network Connections Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1413	Windows Runtime Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1333	Group Policy Services Policy Processing Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1428	Windows Network Connections Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1249	Windows Runtime Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1267	Local Security Authority Subsystem Service Denial of Service Vulnerability
Microsoft Windows	CVE-2020-1399	Windows Runtime Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1365	Windows Event Logging Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1366	Windows Print Workflow Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1359	Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1363	Windows Picker Platform Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1370	Windows Runtime Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1373	Windows Network Connections Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1374	Remote Desktop Client Remote Code Execution Vulnerability
Microsoft Windows	CVE-2020-1371	Windows Event Logging Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1372	Windows Mobile Device Management Diagnostics Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1356	Windows iSCSI Target Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1420	Windows Error Reporting Information Disclosure Vulnerability
Microsoft Windows	CVE-2020-1421	LNK Remote Code Execution Vulnerability
Microsoft Windows	CVE-2020-1350	Windows DNS Server Remote Code Execution Vulnerability
Microsoft Windows	CVE-2020-1418	Windows Diagnostics Hub Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1422	Windows Runtime Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1353	Windows Runtime Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1354	Windows UPnP Device Host Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1347	Windows Storage Services Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1352	Windows USO Core Worker Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1375	Windows COM Server Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1390	Windows Network Connections Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1391	Windows Agent Activation Runtime Information Disclosure Vulnerability
Microsoft Windows	CVE-2020-1386	Connected User Experiences and Telemetry Service Information Disclosure Vulnerability
Microsoft Windows	CVE-2020-1387	Windows Push Notification Service Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1395	Windows Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1398	Windows Lockscreen Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1393	Windows Diagnostics Hub Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1394	Windows Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1385	Windows Credential Picker Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-1384	Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
Open Source Software	CVE-2020-1469	Bond Denial of Service Vulnerability
Skype for Business	CVE-2020-1025	Microsoft Office Elevation of Privilege Vulnerability
Visual Studio	CVE-2020-1416	Visual Studio and Visual Studio Code Elevation of Privilege Vulnerability
Visual Studio	CVE-2020-1481	Visual Studio Code ESLint Extention Remote Code Execution Vulnerability
Windows Hyper-V	CVE-2020-1041	Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
Windows Hyper-V	CVE-2020-1040	Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
Windows Hyper-V	CVE-2020-1032	Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
Windows Hyper-V	CVE-2020-1036	Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
Windows Hyper-V	CVE-2020-1042	Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
Windows Hyper-V	CVE-2020-1043	Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
Windows Kernel	CVE-2020-1367	Windows Kernel Information Disclosure Vulnerability
Windows Kernel	CVE-2020-1396	Windows ALPC Elevation of Privilege Vulnerability
Windows Kernel	CVE-2020-1336	Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel	CVE-2020-1419	Windows Kernel Information Disclosure Vulnerability
Windows Kernel	CVE-2020-1426	Windows Kernel Information Disclosure Vulnerability
Windows Kernel	CVE-2020-1358	Windows Resource Policy Information Disclosure Vulnerability
Windows Kernel	CVE-2020-1388	Windows Elevation of Privilege Vulnerability
Windows Kernel	CVE-2020-1389	Windows Kernel Information Disclosure Vulnerability
Windows Kernel	CVE-2020-1357	Windows System Events Broker Elevation of Privilege Vulnerability
Windows Kernel	CVE-2020-1411	Windows Kernel Elevation of Privilege Vulnerability
Windows Shell	CVE-2020-1415	Windows Runtime Elevation of Privilege Vulnerability
Windows Shell	CVE-2020-1360	Windows Profile Service Elevation of Privilege Vulnerability
Windows Shell	CVE-2020-1414	Windows Runtime Elevation of Privilege Vulnerability
Windows Shell	CVE-2020-1368	Windows Credential Enrollment Manager Service Elevation of Privilege Vulnerability
Windows Subsystem for Linux	CVE-2020-1423	Windows Subsystem for Linux Elevation of Privilege Vulnerability
Windows Update Stack	CVE-2020-1392	Windows Elevation of Privilege Vulnerability
Windows Update Stack	CVE-2020-1346	Windows Modules Installer Elevation of Privilege Vulnerability
Windows Update Stack	CVE-2020-1424	Windows Update Stack Elevation of Privilege Vulnerability
Windows WalletService	CVE-2020-1344	Windows WalletService Elevation of Privilege Vulnerability
Windows WalletService	CVE-2020-1364	Windows WalletService Denial of Service Vulnerability
Windows WalletService	CVE-2020-1369	Windows WalletService Elevation of Privilege Vulnerability
Windows WalletService	CVE-2020-1361	Windows WalletService Information Disclosure Vulnerability
Windows WalletService	CVE-2020-1362	Windows WalletService Elevation of Privilege Vulnerability

ANZEIGE
Netzwerksicherheit und Netzwerkmonitoring in der neuen Normalität
Die Gigamon Visibility Platform ist der Katalysator für die schnelle und optimierte Bereitstellung des Datenverkehrs für Sicherheitstools, Netzwerkperformance- und Applikationsperformance-Monitoring. Erfahren Sie in diesem Webinar, wie Sie mit Gigamon-Lösungen die Effizienz ihrer Sicherheitsarchitektur steigern und Kosten einsparen können.
Jetzt registrieren und Aufzeichnung ansehen.