Microsoft November 2020 Patch Tuesday arrives with fix for Windows zero-day

Microsoft released today its monthly roll-up of security patches known as Patch Tuesday. This month, the Redmond-based company fixed 112 security bugs across a wide range of products, from Microsoft Edge to the Windows WalletService .

This month’s patches also include a fix for a Windows zero-day vulnerability that was exploited in the wild.

Tracked as CVE-2020-17087, the zero-day was disclosed on October 30 by the Google Project Zero and TAG security teams. Google said the vulnerability was being exploited together with a Chrome zero-day to target Windows 7 and Windows 10 users.

Attackers would use the Chrome zero-day to run malicious code inside Chrome and then use the Windows zero-day to escape the Chrome security sandbox and elevate the code’s privileges to attack the underlying OS.

Details about the attack were not published beyond this simple description.

Google discovered the zero-day around mid-October and gave Microsoft seven days to release a patch. Since releasing a security patch for any Microsoft product —and especially the bulky Windows OS— takes time to test and fine-tune, the patch was not ready during the original seven-day disclosure timeline. But it is available starting today.

According to Microsoft’s security advisory for CVE-2020-17087, the zero-day resides in the Windows kernel and impacts all currently supported versions of the Windows OS. This includes all versions after Windows 7, and all Windows Server distributions.

But besides the Windows zero-day, there are 111 other vulnerabilities that need to be patched as well, including 24 bugs that can allow remote code execution (RCE) attacks in apps such as Excel, Microsoft Sharepoint, Microsoft Exchange Server, the Windows Network File System, the Windows GDI+ component, the Windows printing spooler service, and even in Microsoft Teams.

While rushing to install patches is a safe approach for most users, system administrators of large networks are advised to test the patches before a broad rollout to avoid any bugs or changes that break internal systems.

Below are additional details about today’s Microsoft Patch Tuesday and security updates released by other tech companies:

• Microsoft’s official Security Update Guide portal lists all security updates in a filterable table.
• ZDNet has published this file listing all this month’s security advisories on one single page.
• Adobe’s security updates are detailed here.
• SAP security updates are available here.
• Intel security updates are available here.
• VMWare security updates are available here.
• Chrome 86 security updates are detailed here.
• Android security updates are available here.

Source: Information Technologies - zdnet.com