Microsoft Patch Tuesday — March 2020: Vulnerability disclosures and Snort coverage

Summary: Microsoft's March 2020 Patch Tuesday covered 117 vulnerabilities, 25 of them critical, with fixes touching Microsoft Media Foundation, the GDI+ API and Windows Defender, and Microsoft later issued an out-of-band patch for CVE-2020-0796, an SMB code execution flaw an unauthenticated attacker could use to run remote code. Talos released Snort rules for several of the flaws, including 53425-53428 for CVE-2020-0796, and detailed bugs such as CVE-2020-0684, a remote code execution flaw triggered when a user opens a malicious .LNK file from a removable drive or remote share.
What you should know: CVE-2020-0796 needs no authentication and drew an out-of-band patch days after the monthly release, so any SMB-exposed system left unpatched is reachable by an attacker who never has to steal a credential first.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-0684 CVE-2020-0761 CVE-2020-0796 CVE-2020-0801 CVE-2020-0807 CVE-2020-0809 CVE-2020-0823 CVE-2020-0824 CVE-2020-0825 CVE-2020-0826 CVE-2020-0827 CVE-2020-0828 CVE-2020-0829 CVE-2020-0831 CVE-2020-0832 CVE-2020-0833 CVE-2020-0847 CVE-2020-0848 CVE-2020-0850 CVE-2020-0851 CVE-2020-0852 CVE-2020-0855 CVE-2020-0869 CVE-2020-0881 CVE-2020-0883
Related: CVE-2020-0796: Microsoft SMBv3 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 10, 2022
Microsoft Patch Tuesday, March 2020 Edition Cyber Risks ·
Microsoft Patch Tuesday, April 2020 Edition Cyber Risks ·