Microsoft Patch Tuesday for Sept. 2020 — Snort rules and prominent vulnerabilities

Summary: Microsoft's September 2020 security update disclosed more than 120 vulnerabilities across its products, 23 of them rated critical and the rest important, spanning Office, Windows Media Audio Decoder and Hyper-V. Talos highlighted CVE-2020-0922 in Microsoft COM, a remote code execution bug with a CVSS score of 8.8 that triggers when a user opens an attacker-controlled web page containing crafted JavaScript, and released Snort rules 55139-55146, 55161, 55162, 55187, 55188 and 55206 to detect exploitation attempts.
Key Takeaway: Twenty-three critical bugs in one month, several exploitable simply by a user opening a malicious web page or a phishing attachment, means patch latency alone is the exposure window. Talos also singled out CVE-2020-1115, a privilege escalation flaw it discovered itself in the Windows 10 Common Log File System.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-0922 CVE-2020-1057 CVE-2020-1115 CVE-2020-1172 CVE-2020-1193 CVE-2020-1218 CVE-2020-1332 CVE-2020-1508 CVE-2020-1593 CVE-2020-1594
Related: Vulnerability Spotlight: Privilege escalation in Windows 10 CLFS driver Cyber Risks ·
Threat Source newsletter for Sept. 10, 2020 Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026