Patch Tuesday, January 2020 Edition
Summary: Microsoft released updates fixing 50 security holes in Windows and related software, including a patch for CVE-2020-0601, a Windows 10 and Windows Server 2016/19 flaw reported by the NSA that lets an attacker spoof the digital signature tied to a piece of software. The NSA advisory warns the flaw lets attackers defeat trusted network connections and deliver executable code while appearing as legitimately trusted entities, and the same month marks the end of mainstream support for Windows 7, which will no longer receive security updates.
What's compelling: The NSA itself assessed that sophisticated cyber actors will understand the underlying flaw very quickly, and researchers and attackers were already teasing out exploit methods the evening the patch shipped - so the window between disclosure and exploitation is measured in hours or days, not weeks.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-0601
- Related
- CVE-2020-0601: Microsoft Windows CryptoAPI Spoofing Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021