Kaspersky Threats

Detect date

?

03/10/2020

Severity

?

Critical

Description

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, execute arbitrary code, spoof user interface, cause denial of service.

Below is a complete list of vulnerabilities:

An elevation of privilege vulnerability in Diagnostic Hub Standard Collector can be exploited remotely via specially crafted application to gain privileges.
An elevation of privilege vulnerability in Diagnostics Hub Standard Collector can be exploited remotely to gain privileges.
An elevation of privilege vulnerability in Windows Installer can be exploited to gain privileges.
An elevation of privilege vulnerability in Windows Update Orchestrator Service can be exploited remotely via specially crafted application to gain privileges.
An elevation of privilege vulnerability in Windows Installer can be exploited remotely to gain privileges.
An information disclosure vulnerability in Windows Modules Installer Service can be exploited remotely via specially crafted application to obtain sensitive information.
An elevation of privilege vulnerability in Win32k can be exploited remotely via specially crafted application to gain privileges.
An elevation of privilege vulnerability in Windows Mobile Device Management Diagnostics can be exploited remotely via specially crafted application to gain privileges.
An elevation of privilege vulnerability in Windows Device Setup Manager can be exploited to gain privileges.
An elevation of privilege vulnerability exists in Windows Search Indexer can be exploited to gain privileges.
An elevation of privilege vulnerability in Windows ALPC can be exploited remotely via specially crafted application to gain privileges.
An information disclosure vulnerability in Windows Imaging Component can be exploited to obtain sensitive information.
An elevation of privilege vulnerability in Windows Graphics Component can be exploited remotely via specially crafted application to gain privileges.
An information disclosure vulnerability in Windows GDI can be exploited remotely via specially crafted application to obtain sensitive information.
An information disclosure vulnerability in Windows Network Connections Service can be exploited remotely via specially crafted application to obtain sensitive information.
A memory corruption vulnerability in Media Foundation can be exploited remotely via specially crafted document to execute arbitrary code.
An elevation of privilege vulnerability in Windows can be exploited remotely via specially crafted application to gain privileges.
An elevation of privilege vulnerability in Windows Background Intelligent Transfer Service can be exploited remotely via specially crafted application to gain privileges.
An elevation of privilege vulnerability in Windows Hard Link can be exploited remotely via specially crafted application to gain privileges.
A tampering vulnerability in Microsoft IIS Server can be exploited remotely to spoof user interface.
An elevation of privilege vulnerability in Windows Defender Security Center can be exploited remotely to gain privileges.
An elevation of privilege vulnerability in Windows Defender Security Center can be exploited remotely via specially crafted command to gain privileges.
An elevation of privilege vulnerability in Windows Network List Service can be exploited remotely via specially crafted application to gain privileges.
An elevation of privilege vulnerability in Windows Universal Plug and Play (UPnP) service can be exploited to gain privileges.
An elevation of privilege vulnerability in Windows UPnP Service can be exploited remotely via specially crafted script to gain privileges.
An information disclosure vulnerability in Windows GDI can be exploited remotely via specially crafted document to obtain sensitive information.
An elevation of privilege vulnerability in Windows User Profile Service can be exploited remotely via specially crafted application to gain privileges.
A denial of service vulnerability in Windows Tile Object Service can be exploited remotely via specially crafted application to cause denial of service.
An elevation of privilege vulnerability in Windows CSC Service can be exploited remotely via specially crafted application to gain privileges.
An elevation of privilege vulnerability in Windows Work Folder Service can be exploited remotely via specially crafted application to gain privileges.
A remote code execution vulnerability in LNK can be exploited remotely to execute arbitrary code.
An elevation of privilege vulnerability in Windows Network Connections Service can be exploited remotely via specially crafted application to gain privileges.
An elevation of privilege vulnerability in Windows Error Reporting can be exploited remotely via specially crafted application to gain privileges.
An information disclosure vulnerability in Media Foundation can be exploited remotely via specially crafted application to obtain sensitive information.
An elevation of privilege vulnerability in Windows Language Pack Installer can be exploited remotely via specially crafted application to gain privileges.
An elevation of privilege vulnerability in Provisioning Runtime can be exploited remotely to gain privileges.
An elevation of privilege vulnerability in Windows ActiveX Installer Service can be exploited remotely via specially crafted application to gain privileges.
An information disclosure vulnerability in Connected User Experiences and Telemetry Service can be exploited remotely via specially crafted application to obtain sensitive information.
An elevation of privilege vulnerability in Connected User Experiences and Telemetry Service can be exploited remotely via specially crafted application to gain privileges.
An information disclosure vulnerability in Windows Graphics Component can be exploited remotely via specially crafted document to obtain sensitive information.
A remote code execution vulnerability in GDI+ can be exploited remotely via specially crafted website to execute arbitrary code.
An information disclosure vulnerability in Windows Error Reporting can be exploited remotely via specially crafted application to obtain sensitive information.
An information disclosure vulnerability in Win32k can be exploited remotely via specially crafted application to obtain sensitive information.
An elevation of privilege vulnerability in Windows Kernel can be exploited remotely via specially crafted application to gain privileges.
An elevation of privilege vulnerability in DirectX can be exploited remotely via specially crafted application to gain privileges.
An information disclosure vulnerability in Windows Network Driver Interface Specification (NDIS) can be exploited remotely via specially crafted application to obtain sensitive information.

Microsoft is aware of a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client.

To exploit the vulnerability against an SMB Server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 Server. To exploit the vulnerability against an SMB Client, an unauthenticated attacker would need to configure a malicious SMBv3 Server and convince a user to connect to it.

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Affected products

Windows 10 Version 1803 for 32-bit Systems
Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
Windows RT 8.1
Windows Server 2019 (Server Core installation)
Windows 10 Version 1709 for 32-bit Systems
Windows Server 2016 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows 10 for x64-based Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows 10 Version 1909 for 32-bit Systems
Windows Server, version 1903 (Server Core installation)
Windows Server 2012 R2 (Server Core installation)
Microsoft Visual Studio 2019 version 16.0
Windows 10 Version 1709 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 8.1 for x64-based systems
Windows Server, version 1909 (Server Core installation)
Microsoft Visual Studio 2015 Update 3
Windows 10 Version 1903 for x64-based Systems
Windows Server 2012
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 8.1 for 32-bit systems
Windows 10 Version 1809 for ARM64-based Systems
Windows Server 2012 (Server Core installation)
Windows 10 for 32-bit Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1709 for x64-based Systems
Windows Server, version 1803 (Server Core Installation)
Windows 10 Version 1809 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2016
Windows Server 2008 for x64-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2012 R2
Windows Server 2019
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows Server, version 2004 (Server Core installation)
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 2004 for x64-based Systems

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories

CVE-2020-0810
CVE-2020-0867
CVE-2020-0814
CVE-2020-0859
CVE-2020-0788
CVE-2020-0854
CVE-2020-0834
CVE-2020-0898
CVE-2020-0877
CVE-2020-0874
CVE-2020-0871
CVE-2020-0869
CVE-2020-0858
CVE-2020-0787
CVE-2020-0849
CVE-2020-0896
CVE-2020-0879
CVE-2020-0645
CVE-2020-0763
CVE-2020-0780
CVE-2020-0783
CVE-2020-0882
CVE-2020-0785
CVE-2020-0786
CVE-2020-0769
CVE-2020-0864
CVE-2020-0684
CVE-2020-0774
CVE-2020-0897
CVE-2020-0845
CVE-2020-0807
CVE-2020-0806
CVE-2020-0804
CVE-2020-0803
CVE-2020-0802
CVE-2020-0801
CVE-2020-0800
CVE-2020-0820
CVE-2020-0822
CVE-2020-0809
CVE-2020-0808
CVE-2020-0865
CVE-2020-0842
CVE-2020-0841
CVE-2020-0840
CVE-2020-0843
CVE-2020-0860
CVE-2020-0863
CVE-2020-0844
CVE-2020-0887
CVE-2020-0885
CVE-2020-0883
CVE-2020-0868
CVE-2020-0881
CVE-2020-0880
CVE-2020-0775
CVE-2020-0876
CVE-2020-0777
CVE-2020-0776
CVE-2020-0771
CVE-2020-0799
CVE-2020-0773
CVE-2020-0798
CVE-2020-0797
CVE-2020-0772
CVE-2020-0793
CVE-2020-0778
CVE-2020-0791
CVE-2020-0690
CVE-2020-0866
CVE-2020-0770
CVE-2020-0861
CVE-2020-0779
CVE-2020-0819
CVE-2020-0857
CVE-2020-0853
CVE-2020-0762
CVE-2020-0781
ADV200005

Impacts

?

ACE

[?]

OSI

[?]

DoS

[?]

PE

[?]

SUI

[?]

Detect date ?	03/10/2020
Severity ?	Critical
Description	Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, execute arbitrary code, spoof user interface, cause denial of service. Below is a complete list of vulnerabilities: An elevation of privilege vulnerability in Diagnostic Hub Standard Collector can be exploited remotely via specially crafted application to gain privileges. An elevation of privilege vulnerability in Diagnostics Hub Standard Collector can be exploited remotely to gain privileges. An elevation of privilege vulnerability in Windows Installer can be exploited to gain privileges. An elevation of privilege vulnerability in Windows Update Orchestrator Service can be exploited remotely via specially crafted application to gain privileges. An elevation of privilege vulnerability in Windows Installer can be exploited remotely to gain privileges. An information disclosure vulnerability in Windows Modules Installer Service can be exploited remotely via specially crafted application to obtain sensitive information. An elevation of privilege vulnerability in Win32k can be exploited remotely via specially crafted application to gain privileges. An elevation of privilege vulnerability in Windows Mobile Device Management Diagnostics can be exploited remotely via specially crafted application to gain privileges. An elevation of privilege vulnerability in Windows Device Setup Manager can be exploited to gain privileges. An elevation of privilege vulnerability exists in Windows Search Indexer can be exploited to gain privileges. An elevation of privilege vulnerability in Windows ALPC can be exploited remotely via specially crafted application to gain privileges. An information disclosure vulnerability in Windows Imaging Component can be exploited to obtain sensitive information. An elevation of privilege vulnerability in Windows Graphics Component can be exploited remotely via specially crafted application to gain privileges. An information disclosure vulnerability in Windows GDI can be exploited remotely via specially crafted application to obtain sensitive information. An information disclosure vulnerability in Windows Network Connections Service can be exploited remotely via specially crafted application to obtain sensitive information. A memory corruption vulnerability in Media Foundation can be exploited remotely via specially crafted document to execute arbitrary code. An elevation of privilege vulnerability in Windows can be exploited remotely via specially crafted application to gain privileges. An elevation of privilege vulnerability in Windows Background Intelligent Transfer Service can be exploited remotely via specially crafted application to gain privileges. An elevation of privilege vulnerability in Windows Hard Link can be exploited remotely via specially crafted application to gain privileges. A tampering vulnerability in Microsoft IIS Server can be exploited remotely to spoof user interface. An elevation of privilege vulnerability in Windows Defender Security Center can be exploited remotely to gain privileges. An elevation of privilege vulnerability in Windows Defender Security Center can be exploited remotely via specially crafted command to gain privileges. An elevation of privilege vulnerability in Windows Network List Service can be exploited remotely via specially crafted application to gain privileges. An elevation of privilege vulnerability in Windows Universal Plug and Play (UPnP) service can be exploited to gain privileges. An elevation of privilege vulnerability in Windows UPnP Service can be exploited remotely via specially crafted script to gain privileges. An information disclosure vulnerability in Windows GDI can be exploited remotely via specially crafted document to obtain sensitive information. An elevation of privilege vulnerability in Windows User Profile Service can be exploited remotely via specially crafted application to gain privileges. A denial of service vulnerability in Windows Tile Object Service can be exploited remotely via specially crafted application to cause denial of service. An elevation of privilege vulnerability in Windows CSC Service can be exploited remotely via specially crafted application to gain privileges. An elevation of privilege vulnerability in Windows Work Folder Service can be exploited remotely via specially crafted application to gain privileges. A remote code execution vulnerability in LNK can be exploited remotely to execute arbitrary code. An elevation of privilege vulnerability in Windows Network Connections Service can be exploited remotely via specially crafted application to gain privileges. An elevation of privilege vulnerability in Windows Error Reporting can be exploited remotely via specially crafted application to gain privileges. An information disclosure vulnerability in Media Foundation can be exploited remotely via specially crafted application to obtain sensitive information. An elevation of privilege vulnerability in Windows Language Pack Installer can be exploited remotely via specially crafted application to gain privileges. An elevation of privilege vulnerability in Provisioning Runtime can be exploited remotely to gain privileges. An elevation of privilege vulnerability in Windows ActiveX Installer Service can be exploited remotely via specially crafted application to gain privileges. An information disclosure vulnerability in Connected User Experiences and Telemetry Service can be exploited remotely via specially crafted application to obtain sensitive information. An elevation of privilege vulnerability in Connected User Experiences and Telemetry Service can be exploited remotely via specially crafted application to gain privileges. An information disclosure vulnerability in Windows Graphics Component can be exploited remotely via specially crafted document to obtain sensitive information. A remote code execution vulnerability in GDI+ can be exploited remotely via specially crafted website to execute arbitrary code. An information disclosure vulnerability in Windows Error Reporting can be exploited remotely via specially crafted application to obtain sensitive information. An information disclosure vulnerability in Win32k can be exploited remotely via specially crafted application to obtain sensitive information. An elevation of privilege vulnerability in Windows Kernel can be exploited remotely via specially crafted application to gain privileges. An elevation of privilege vulnerability in DirectX can be exploited remotely via specially crafted application to gain privileges. An information disclosure vulnerability in Windows Network Driver Interface Specification (NDIS) can be exploited remotely via specially crafted application to obtain sensitive information. Microsoft is aware of a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client. To exploit the vulnerability against an SMB Server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 Server. To exploit the vulnerability against an SMB Client, an unauthenticated attacker would need to configure a malicious SMBv3 Server and convince a user to connect to it.
Exploitation	Public exploits exist for this vulnerability. Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.
Affected products	Windows 10 Version 1803 for 32-bit Systems Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) Windows RT 8.1 Windows Server 2019 (Server Core installation) Windows 10 Version 1709 for 32-bit Systems Windows Server 2016 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows 10 Version 1809 for 32-bit Systems Windows 10 Version 1803 for x64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows 10 for x64-based Systems Windows 10 Version 1903 for ARM64-based Systems Windows 7 for x64-based Systems Service Pack 1 Windows 10 Version 1909 for 32-bit Systems Windows Server, version 1903 (Server Core installation) Windows Server 2012 R2 (Server Core installation) Microsoft Visual Studio 2019 version 16.0 Windows 10 Version 1709 for ARM64-based Systems Windows 10 Version 1909 for x64-based Systems Windows Server 2008 for 32-bit Systems Service Pack 2 Windows 8.1 for x64-based systems Windows Server, version 1909 (Server Core installation) Microsoft Visual Studio 2015 Update 3 Windows 10 Version 1903 for x64-based Systems Windows Server 2012 Windows 10 Version 1607 for 32-bit Systems Windows 10 Version 1607 for x64-based Systems Windows 8.1 for 32-bit systems Windows 10 Version 1809 for ARM64-based Systems Windows Server 2012 (Server Core installation) Windows 10 for 32-bit Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows 10 Version 1903 for 32-bit Systems Windows 10 Version 1709 for x64-based Systems Windows Server, version 1803 (Server Core Installation) Windows 10 Version 1809 for x64-based Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2016 Windows Server 2008 for x64-based Systems Service Pack 2 Windows 7 for 32-bit Systems Service Pack 1 Windows Server 2012 R2 Windows Server 2019 Windows 10 Version 1803 for ARM64-based Systems Windows 10 Version 2004 for ARM64-based Systems Windows Server, version 2004 (Server Core installation) Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) Windows 10 Version 2004 for 32-bit Systems Windows 10 Version 2004 for x64-based Systems
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories	CVE-2020-0810 CVE-2020-0867 CVE-2020-0814 CVE-2020-0859 CVE-2020-0788 CVE-2020-0854 CVE-2020-0834 CVE-2020-0898 CVE-2020-0877 CVE-2020-0874 CVE-2020-0871 CVE-2020-0869 CVE-2020-0858 CVE-2020-0787 CVE-2020-0849 CVE-2020-0896 CVE-2020-0879 CVE-2020-0645 CVE-2020-0763 CVE-2020-0780 CVE-2020-0783 CVE-2020-0882 CVE-2020-0785 CVE-2020-0786 CVE-2020-0769 CVE-2020-0864 CVE-2020-0684 CVE-2020-0774 CVE-2020-0897 CVE-2020-0845 CVE-2020-0807 CVE-2020-0806 CVE-2020-0804 CVE-2020-0803 CVE-2020-0802 CVE-2020-0801 CVE-2020-0800 CVE-2020-0820 CVE-2020-0822 CVE-2020-0809 CVE-2020-0808 CVE-2020-0865 CVE-2020-0842 CVE-2020-0841 CVE-2020-0840 CVE-2020-0843 CVE-2020-0860 CVE-2020-0863 CVE-2020-0844 CVE-2020-0887 CVE-2020-0885 CVE-2020-0883 CVE-2020-0868 CVE-2020-0881 CVE-2020-0880 CVE-2020-0775 CVE-2020-0876 CVE-2020-0777 CVE-2020-0776 CVE-2020-0771 CVE-2020-0799 CVE-2020-0773 CVE-2020-0798 CVE-2020-0797 CVE-2020-0772 CVE-2020-0793 CVE-2020-0778 CVE-2020-0791 CVE-2020-0690 CVE-2020-0866 CVE-2020-0770 CVE-2020-0861 CVE-2020-0779 CVE-2020-0819 CVE-2020-0857 CVE-2020-0853 CVE-2020-0762 CVE-2020-0781 ADV200005
Impacts ?	ACE [?] OSI [?] DoS [?] PE [?] SUI [?]
Related products	Microsoft Visual Studio Microsoft Windows Microsoft Windows Server Microsoft Windows Server 2012 Microsoft Windows 8 Microsoft Windows 7 Microsoft Windows Server 2008 Windows RT Microsoft Windows 10
CVE-IDS ?	CVE-2020-08107.2High CVE-2020-07934.6Warning CVE-2020-07792.1Warning CVE-2020-08674.6Warning CVE-2020-08147.2High CVE-2020-08592.1Warning CVE-2020-07887.2High CVE-2020-08543.6Warning CVE-2020-08197.2High CVE-2020-08574.6Warning CVE-2020-08347.2High CVE-2020-08534.3Warning CVE-2020-08987.2High CVE-2020-08777.2High CVE-2020-08742.1Warning CVE-2020-08712.1Warning CVE-2020-08696.8High CVE-2020-08587.2High CVE-2020-07877.2High CVE-2020-08497.2High CVE-2020-08967.2High CVE-2020-08792.1Warning CVE-2020-06455.0Critical CVE-2020-07624.6Warning CVE-2020-07634.6Warning CVE-2020-07804.6Warning CVE-2020-07817.2High CVE-2020-07837.2High CVE-2020-08824.3Warning CVE-2020-07853.6Warning CVE-2020-07865.6High CVE-2020-07694.6Warning CVE-2020-08644.6Warning CVE-2020-06846.8High CVE-2020-07744.3Warning CVE-2020-08974.6Warning CVE-2020-08454.6Warning CVE-2020-08079.3Critical CVE-2020-08064.6Warning CVE-2020-08047.2High CVE-2020-08037.2High CVE-2020-08027.2High CVE-2020-08016.9High CVE-2020-08007.2High CVE-2020-08202.1Warning CVE-2020-08224.6Warning CVE-2020-08099.3Critical CVE-2020-08084.6Warning CVE-2020-08657.2High CVE-2020-08424.6Warning CVE-2020-08417.2High CVE-2020-08407.2High CVE-2020-08434.6Warning CVE-2020-08607.2High CVE-2020-08632.1Warning CVE-2020-08444.6Warning CVE-2020-08877.2High CVE-2020-08854.3Warning CVE-2020-08839.3Critical CVE-2020-08684.6Warning CVE-2020-08819.3Critical CVE-2020-08804.3Warning CVE-2020-07752.1Warning CVE-2020-08765.0Critical CVE-2020-07774.6Warning CVE-2020-07764.6Warning CVE-2020-07714.6Warning CVE-2020-07997.2High CVE-2020-07734.6Warning CVE-2020-07987.2High CVE-2020-07977.2High CVE-2020-07724.6Warning CVE-2020-07784.6Warning CVE-2020-07917.2High CVE-2020-08664.6Warning CVE-2020-07704.6Warning CVE-2020-08617.2High
KB list	4538461 4541510 4540689 4541509 4540681 4540693 4540673 4540670 4540694 4541505 4560960 4557957 4561602 4561608 4561621
Microsoft official advisories	Microsoft Security Update Guide
	Find out the statistics of the vulnerabilities spreading in your region

KLA11689Multiple vulnerabilities in Microsoft Windows

KLA11689
Multiple vulnerabilities in Microsoft Windows