HackDig : Dig high-quality web security articles for hackers

Microsoft fixes critical Outlook bug exploitable via preview pane

2020-10-14 13:18

Microsoft fixes critical Outlook bug exploitable via preview pane

Microsoft has released the October 2020 Office security updates with a total of 24 security updates and 5 cumulative updates for 7 different products, fixing 13 vulnerabilities that could enable remote attackers to execute arbitrary code on vulnerable systems.

The highlight of this month's Microsoft Office security updates is without a doubt CVE-2020-16947, a remote code execution vulnerability that leads to remote code execution when previewing or opening maliciously crafted emails with a vulnerable Microsoft Outlook version.

Exploitation can also be achieved in a web-based attack scenario via sites used to host specially crafted files designed to exploit CVE-2020-16947.

When successfully exploited, the bug allows attackers to run arbitrary code in the context of the System user. The attackers could also take over the targeted system if the currently logged on user has administrative user rights.

CVE-2020-16947 affects several Office products including Microsoft Outlook 2016 and Microsoft Office 2019, as well as Microsoft 365 Apps for Enterprise.

List of Office security issues fixed this month

The October 2020 Patch Tuesday Office security updates address remote code execution (RCE), security bypass, elevation of privilege, denial of service, information disclosure, and cross-site scripting vulnerabilities on Windows systems running vulnerable Microsoft Installer (.msi) and Click to Run editions of Microsoft Office products.

Microsoft rated the 11 RCE security flaws patched this month Critical or Important severity issues seeing that they could enable attackers to execute arbitrary code in the context of the current user after successful exploitation.

The attackers could then install malicious programs, view, change, and delete data, as well as create their own rogue admin accounts on compromised Windows devices.

TagCVE IDTitleSeverity
Microsoft OfficeCVE-2020-16933Microsoft Word Security Feature Bypass VulnerabilityImportant
Microsoft OfficeCVE-2020-16929Microsoft Excel Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2020-16934Microsoft Office Click-to-Run Elevation of Privilege VulnerabilityImportant
Microsoft OfficeCVE-2020-16932Microsoft Excel Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2020-16930Microsoft Excel Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2020-16955Microsoft Office Click-to-Run Elevation of Privilege VulnerabilityImportant
Microsoft OfficeCVE-2020-16928Microsoft Office Click-to-Run Elevation of Privilege VulnerabilityImportant
Microsoft OfficeCVE-2020-16957Microsoft Office Access Connectivity Engine Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2020-16918Base3D Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2020-16949Microsoft Outlook Denial of Service VulnerabilityModerate
Microsoft OfficeCVE-2020-16947Microsoft Outlook Remote Code Execution VulnerabilityCritical
Microsoft OfficeCVE-2020-16931Microsoft Excel Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2020-16954Microsoft Office Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2020-17003Base3D Remote Code Execution VulnerabilityCritical
Microsoft Office SharePointCVE-2020-16948Microsoft SharePoint Information Disclosure VulnerabilityImportant
Microsoft Office SharePointCVE-2020-16953Microsoft SharePoint Information Disclosure VulnerabilityImportant
Microsoft Office SharePointCVE-2020-16942Microsoft SharePoint Information Disclosure VulnerabilityImportant
Microsoft Office SharePointCVE-2020-16951Microsoft SharePoint Remote Code Execution VulnerabilityCritical
Microsoft Office SharePointCVE-2020-16944Microsoft SharePoint Reflective XSS VulnerabilityImportant
Microsoft Office SharePointCVE-2020-16945Microsoft Office SharePoint XSS VulnerabilityImportant
Microsoft Office SharePointCVE-2020-16946Microsoft Office SharePoint XSS VulnerabilityImportant
Microsoft Office SharePointCVE-2020-16941Microsoft SharePoint Information Disclosure VulnerabilityImportant
Microsoft Office SharePointCVE-2020-16950Microsoft SharePoint Information Disclosure VulnerabilityImportant
Microsoft Office SharePointCVE-2020-16952Microsoft SharePoint Remote Code Execution VulnerabilityCritical

October 2020 Microsoft Office security updates

This month's Microsoft Office security updates are delivered via the Microsoft Update platform and through the Download Center.

To download October 2020 Microsoft Office security updates, click on their corresponding knowledge base article below and then scroll down to the 'How to download and install the update' section to grab the updates for your Office product.

More information including CVE IDs is available within the knowledge base articles linked below.

Microsoft Office 2016

ProductKnowledge Base article
Excel 2016Security update for Excel 2016 (KB4486678)
Office 2016Security update for Office 2016 (KB4486682)
Office 2016Security update for Office 2016 (KB4484417)
Outlook 2016Security update for Outlook 2016 (KB4486671)
Word 2016Security update for Word 2016 (KB4486679)

Microsoft Office 2013

ProductKnowledge Base article
Excel 2013Security update for Excel 2013 (KB4486695)
Office 2013Security update for Office 2013 (KB4486688)
Office 2013Security update for Office 2013 (KB4484435)
Outlook 2013Security update for Outlook 2013 (KB4484524)
Word 2013Security update for Word 2013 (KB4486692)

Microsoft Office 2010

ProductKnowledge Base article
Excel 2010Security update for Excel 2010 (KB4486707)
Office 2010Security update for Office 2010 (KB4486700)
Office 2010Security update for Office 2010 (KB4486701)
Outlook 2010Security update for Outlook 2010 (KB4486663)
Word 2010Security update for Word 2010 (KB4486703)

Microsoft SharePoint Server 2019

ProductKnowledge Base article
Office Online ServerSecurity update for Office Online Server (KB4486674)
SharePoint Server 2019Security update for SharePoint Server 2019 (KB4486676)

Microsoft SharePoint Server 2016

ProductKnowledge Base article
SharePoint Enterprise Server 2016Security update for SharePoint Enterprise Server 2016 (KB4486677)

Microsoft SharePoint Server 2013

ProductKnowledge Base article
Office Web Apps Server 2013Security update for Office Web Apps Server 2013 (KB4486689)
Project Server 2013Cumulative update for Project Server 2013 (KB4486691)
SharePoint Enterprise Server 2013Security update for SharePoint Enterprise Server 2013 (KB4486687)
SharePoint Enterprise Server 2013Cumulative update for SharePoint Enterprise Server 2013 (KB4486693)
SharePoint Foundation 2013Security update for SharePoint Foundation 2013 (KB4486694)
SharePoint Foundation 2013Cumulative update for SharePoint Foundation 2013 (KB4486690)

Microsoft SharePoint Server 2010

ProductKnowledge Base article
Project Server 2010Cumulative update for Project Server 2010 (KB4486702)
SharePoint Foundation 2010Security update for SharePoint Foundation 2010 (KB4486708)
SharePoint Server 2010Security update for SharePoint Server 2010 (KB4484531)
SharePoint Server 2010Cumulative update for SharePoint Server 2010 (KB4486705)
SharePoint Server 2010 Excel Web AppSecurity update for SharePoint Server 2010 Excel Web App (KB4462175)

October 2020 Patch Tuesday security updates

Yesterday, Redmond also released the October 2020 Patch Tuesday security updates with security updates for 87 vulnerabilities, 12 of them being rated as Critical, 74 as Important, and one as moderate.

Non-security Windows updates with fixes and improvements were also issued yesterday with the Windows 10 KB4579311 & KB4577671 Cumulative Updates.

As part of this month's Patch Tuesday, Microsoft also addressed a critical vulnerability in the Windows TCP/IP stack tracked as CVE-2020-16898 and dubbed 'Bad Neighbor'.

US Cyber Command warned Microsoft customers to immediately patch the Bad Neighbor bug known to affect multiple client (Windows 10) and server (Windows Server) platforms.


Source: -aiv-elbatiolpxe-gub-kooltuo-lacitirc-sexif-tfosorcim/ytiruces/swen/moc.retupmocgnipeelb.www

Read:151 | Comments:0 | Tags:Security Microsoft exploit

“Microsoft fixes critical Outlook bug exploitable via preview pane”0 Comments

Submit A Comment

Name:

Email:

Blog :

Verification Code:

Tools

Tag Cloud