KLA11689
Multiple vulnerabilities in Microsoft Windows

Обновлено: 21/09/2023
Дата обнаружения
10/03/2020
Уровень угрозы
Critical
Описание

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, execute arbitrary code, spoof user interface, cause denial of service.

Below is a complete list of vulnerabilities:

  1. An elevation of privilege vulnerability in Diagnostic Hub Standard Collector can be exploited remotely via specially crafted application to gain privileges.
  2. An elevation of privilege vulnerability in Diagnostics Hub Standard Collector can be exploited remotely to gain privileges.
  3. An elevation of privilege vulnerability in Windows Installer can be exploited to gain privileges.
  4. An elevation of privilege vulnerability in Windows Update Orchestrator Service can be exploited remotely via specially crafted application to gain privileges.
  5. An elevation of privilege vulnerability in Windows Installer can be exploited remotely to gain privileges.
  6. An information disclosure vulnerability in Windows Modules Installer Service can be exploited remotely via specially crafted application to obtain sensitive information.
  7. An elevation of privilege vulnerability in Win32k can be exploited remotely via specially crafted application to gain privileges.
  8. An elevation of privilege vulnerability in Windows Mobile Device Management Diagnostics can be exploited remotely via specially crafted application to gain privileges.
  9. An elevation of privilege vulnerability in Windows Device Setup Manager can be exploited to gain privileges.
  10. An elevation of privilege vulnerability exists in Windows Search Indexer can be exploited to gain privileges.
  11. An elevation of privilege vulnerability in Windows ALPC can be exploited remotely via specially crafted application to gain privileges.
  12. An information disclosure vulnerability in Windows Imaging Component can be exploited to obtain sensitive information.
  13. An elevation of privilege vulnerability in Windows Graphics Component can be exploited remotely via specially crafted application to gain privileges.
  14. An information disclosure vulnerability in Windows GDI can be exploited remotely via specially crafted application to obtain sensitive information.
  15. An information disclosure vulnerability in Windows Network Connections Service can be exploited remotely via specially crafted application to obtain sensitive information.
  16. A memory corruption vulnerability in Media Foundation can be exploited remotely via specially crafted document to execute arbitrary code.
  17. An elevation of privilege vulnerability in Windows can be exploited remotely via specially crafted application to gain privileges.
  18. An elevation of privilege vulnerability in Windows Background Intelligent Transfer Service can be exploited remotely via specially crafted application to gain privileges.
  19. An elevation of privilege vulnerability in Windows Hard Link can be exploited remotely via specially crafted application to gain privileges.
  20. A tampering vulnerability in Microsoft IIS Server can be exploited remotely to spoof user interface.
  21. An elevation of privilege vulnerability in Windows Defender Security Center can be exploited remotely to gain privileges.
  22. An elevation of privilege vulnerability in Windows Defender Security Center can be exploited remotely via specially crafted command to gain privileges.
  23. An elevation of privilege vulnerability in Windows Network List Service can be exploited remotely via specially crafted application to gain privileges.
  24. An elevation of privilege vulnerability in Windows Universal Plug and Play (UPnP) service can be exploited to gain privileges.
  25. An elevation of privilege vulnerability in Windows UPnP Service can be exploited remotely via specially crafted script to gain privileges.
  26. An information disclosure vulnerability in Windows GDI can be exploited remotely via specially crafted document to obtain sensitive information.
  27. An elevation of privilege vulnerability in Windows User Profile Service can be exploited remotely via specially crafted application to gain privileges.
  28. A denial of service vulnerability in Windows Tile Object Service can be exploited remotely via specially crafted application to cause denial of service.
  29. An elevation of privilege vulnerability in Windows CSC Service can be exploited remotely via specially crafted application to gain privileges.
  30. An elevation of privilege vulnerability in Windows Work Folder Service can be exploited remotely via specially crafted application to gain privileges.
  31. A remote code execution vulnerability in LNK can be exploited remotely to execute arbitrary code.
  32. An elevation of privilege vulnerability in Windows Network Connections Service can be exploited remotely via specially crafted application to gain privileges.
  33. An elevation of privilege vulnerability in Windows Error Reporting can be exploited remotely via specially crafted application to gain privileges.
  34. An information disclosure vulnerability in Media Foundation can be exploited remotely via specially crafted application to obtain sensitive information.
  35. An elevation of privilege vulnerability in Windows Language Pack Installer can be exploited remotely via specially crafted application to gain privileges.
  36. An elevation of privilege vulnerability in Provisioning Runtime can be exploited remotely to gain privileges.
  37. An elevation of privilege vulnerability in Windows ActiveX Installer Service can be exploited remotely via specially crafted application to gain privileges.
  38. An information disclosure vulnerability in Connected User Experiences and Telemetry Service can be exploited remotely via specially crafted application to obtain sensitive information.
  39. An elevation of privilege vulnerability in Connected User Experiences and Telemetry Service can be exploited remotely via specially crafted application to gain privileges.
  40. An information disclosure vulnerability in Windows Graphics Component can be exploited remotely via specially crafted document to obtain sensitive information.
  41. A remote code execution vulnerability in GDI+ can be exploited remotely via specially crafted website to execute arbitrary code.
  42. An information disclosure vulnerability in Windows Error Reporting can be exploited remotely via specially crafted application to obtain sensitive information.
  43. An information disclosure vulnerability in Win32k can be exploited remotely via specially crafted application to obtain sensitive information.
  44. An elevation of privilege vulnerability in Windows Kernel can be exploited remotely via specially crafted application to gain privileges.
  45. An elevation of privilege vulnerability in DirectX can be exploited remotely via specially crafted application to gain privileges.
  46. An information disclosure vulnerability in Windows Network Driver Interface Specification (NDIS) can be exploited remotely via specially crafted application to obtain sensitive information.

Microsoft is aware of a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client.

To exploit the vulnerability against an SMB Server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 Server. To exploit the vulnerability against an SMB Client, an unauthenticated attacker would need to configure a malicious SMBv3 Server and convince a user to connect to it.

Эксплуатация

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Пораженные продукты

Windows 10 Version 1803 for 32-bit Systems
Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
Windows RT 8.1
Windows Server 2019 (Server Core installation)
Windows 10 Version 1709 for 32-bit Systems
Windows Server 2016 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows 10 for x64-based Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows 10 Version 1909 for 32-bit Systems
Windows Server, version 1903 (Server Core installation)
Windows Server 2012 R2 (Server Core installation)
Microsoft Visual Studio 2019 version 16.0
Windows 10 Version 1709 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 8.1 for x64-based systems
Windows Server, version 1909 (Server Core installation)
Microsoft Visual Studio 2015 Update 3
Windows 10 Version 1903 for x64-based Systems
Windows Server 2012
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 8.1 for 32-bit systems
Windows 10 Version 1809 for ARM64-based Systems
Windows Server 2012 (Server Core installation)
Windows 10 for 32-bit Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1709 for x64-based Systems
Windows Server, version 1803 (Server Core Installation)
Windows 10 Version 1809 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2016
Windows Server 2008 for x64-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2012 R2
Windows Server 2019
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows Server, version 2004 (Server Core installation)
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 2004 for x64-based Systems

Решение

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Первичный источник обнаружения
CVE-2020-0810
CVE-2020-0867
CVE-2020-0814
CVE-2020-0859
CVE-2020-0788
CVE-2020-0854
CVE-2020-0834
CVE-2020-0898
CVE-2020-0877
CVE-2020-0874
CVE-2020-0871
CVE-2020-0869
CVE-2020-0858
CVE-2020-0787
CVE-2020-0849
CVE-2020-0896
CVE-2020-0879
CVE-2020-0645
CVE-2020-0763
CVE-2020-0780
CVE-2020-0783
CVE-2020-0882
CVE-2020-0785
CVE-2020-0786
CVE-2020-0769
CVE-2020-0864
CVE-2020-0684
CVE-2020-0774
CVE-2020-0897
CVE-2020-0845
CVE-2020-0807
CVE-2020-0806
CVE-2020-0804
CVE-2020-0803
CVE-2020-0802
CVE-2020-0801
CVE-2020-0800
CVE-2020-0820
CVE-2020-0822
CVE-2020-0809
CVE-2020-0808
CVE-2020-0865
CVE-2020-0842
CVE-2020-0841
CVE-2020-0840
CVE-2020-0843
CVE-2020-0860
CVE-2020-0863
CVE-2020-0844
CVE-2020-0887
CVE-2020-0885
CVE-2020-0883
CVE-2020-0868
CVE-2020-0881
CVE-2020-0880
CVE-2020-0775
CVE-2020-0876
CVE-2020-0777
CVE-2020-0776
CVE-2020-0771
CVE-2020-0799
CVE-2020-0773
CVE-2020-0798
CVE-2020-0797
CVE-2020-0772
CVE-2020-0793
CVE-2020-0778
CVE-2020-0791
CVE-2020-0690
CVE-2020-0866
CVE-2020-0770
CVE-2020-0861
CVE-2020-0779
CVE-2020-0819
CVE-2020-0857
CVE-2020-0853
CVE-2020-0762
CVE-2020-0781
ADV200005
Оказываемое влияние
?
ACE 
[?]

OSI 
[?]

DoS 
[?]

PE 
[?]

SUI 
[?]
Связанные продукты
Microsoft Visual Studio
Microsoft Windows
Microsoft Windows Server
Microsoft Windows Server 2012
Microsoft Windows 8
Microsoft Windows 7
Microsoft Windows Server 2008
Windows RT
Microsoft Windows 10
CVE-IDS
CVE-2020-08107.2High
CVE-2020-07934.6Warning
CVE-2020-07792.1Warning
CVE-2020-08674.6Warning
CVE-2020-08147.2High
CVE-2020-08592.1Warning
CVE-2020-07887.2High
CVE-2020-08543.6Warning
CVE-2020-08197.2High
CVE-2020-08574.6Warning
CVE-2020-08347.2High
CVE-2020-08534.3Warning
CVE-2020-08987.2High
CVE-2020-08777.2High
CVE-2020-08742.1Warning
CVE-2020-08712.1Warning
CVE-2020-08696.8High
CVE-2020-08587.2High
CVE-2020-07877.2High
CVE-2020-08497.2High
CVE-2020-08967.2High
CVE-2020-08792.1Warning
CVE-2020-06455.0Critical
CVE-2020-07624.6Warning
CVE-2020-07634.6Warning
CVE-2020-07804.6Warning
CVE-2020-07817.2High
CVE-2020-07837.2High
CVE-2020-08824.3Warning
CVE-2020-07853.6Warning
CVE-2020-07865.6High
CVE-2020-07694.6Warning
CVE-2020-08644.6Warning
CVE-2020-06846.8High
CVE-2020-07744.3Warning
CVE-2020-08974.6Warning
CVE-2020-08454.6Warning
CVE-2020-08079.3Critical
CVE-2020-08064.6Warning
CVE-2020-08047.2High
CVE-2020-08037.2High
CVE-2020-08027.2High
CVE-2020-08016.9High
CVE-2020-08007.2High
CVE-2020-08202.1Warning
CVE-2020-08224.6Warning
CVE-2020-08099.3Critical
CVE-2020-08084.6Warning
CVE-2020-08657.2High
CVE-2020-08424.6Warning
CVE-2020-08417.2High
CVE-2020-08407.2High
CVE-2020-08434.6Warning
CVE-2020-08607.2High
CVE-2020-08632.1Warning
CVE-2020-08444.6Warning
CVE-2020-08877.2High
CVE-2020-08854.3Warning
CVE-2020-08839.3Critical
CVE-2020-08684.6Warning
CVE-2020-08819.3Critical
CVE-2020-08804.3Warning
CVE-2020-07752.1Warning
CVE-2020-08765.0Critical
CVE-2020-07774.6Warning
CVE-2020-07764.6Warning
CVE-2020-07714.6Warning
CVE-2020-07997.2High
CVE-2020-07734.6Warning
CVE-2020-07987.2High
CVE-2020-07977.2High
CVE-2020-07724.6Warning
CVE-2020-07784.6Warning
CVE-2020-07917.2High
CVE-2020-08664.6Warning
CVE-2020-07704.6Warning
CVE-2020-08617.2High
KB list

4538461
4541510
4540689
4541509
4540681
4540693
4540673
4540670
4540694
4541505
4560960
4557957
4561602
4561608
4561621