Microsoft Patches All Your Windows Problems (Mostly)

Posted on by

Why you need this article

On Tuesday (2/11/2020) Microsoft released a litany (99 to be exact) of security fixes bundled in a new patch designed to resolve a number of security vulnerabilities. Additionally, an Enablement Package is included which unlocks some new and exciting features.

About The Update

The update patch released Tuesday focuses very heavily on fixes for Zero day vulnerabilities and Internet Explorer. Every part of this patch is security related so it’s highly advised that you allow this one to be installed. While the update doesn’t need any user intervention to install, checking for updates to make sure you are ‘Up to Date’ and no updates are pending is a great idea. Microsoft currently isn’t aware of any known issues in these two patches, so they should be pretty safe to install for everyone.

With the release of the February 2020 security updates, Microsoft has released one advisory for Flash Player and fixes for 99 vulnerabilities in Microsoft products. Of these vulnerabilities, 10 are classified as Critical, 87 as Important, and 2 as Moderate.

Critical, Important, Moderate

So what's the difference? Microsoft uses a number of terms when defining the class or necessity of an update. For the most part these descriptions are relatively simple to understand but once you get to Security updates it's important to know exactly which updates are the most needed.

See below for a quick and dirty run-down of each type, directly from Microsoft.

Priority One

Earlier this year Microsoft released an advisory about an Internet Explorer zero-day vulnerability (CVE-2020-0674) that was recorded publicly exploiting users. Tuesday's update includes a security update that directly addresses this vulnerability.

CVE-2020-0674 | Scripting Engine Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.

The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.

Published: 02/11/2020 | Last Updated : 02/12/2020
Microsoft

Critical Patches

In addition to the CVE-2020-0674 IE vulnerability, Microsoft states that three other vulnerabilities were publicly disclosed but not exploited in the wild (as far as they know).

These vulnerabilities are:

  • CVE-2020-0683 – Windows Installer Elevation of Privilege Vulnerability
  • CVE-2020-0686 – Windows Installer Elevation of Privilege Vulnerability
  • CVE-2020-0706 – Microsoft Browser Information Disclosure Vulnerability

Image1

Enablement Package

Windows 10, versions 1903 and 1909 share a common core operating system and an identical set of system files. As a result, the new features in Windows 10, version 1909 were included in the monthly quality update for Windows 10, version 1903 (released October 8, 2019), but were in a dormant state. These new features will remain dormant until they are turned on using an enablement package, which is a small, quick-to-install “master switch” that simply activates the Windows 10, version 1909 features.

Included in the latest Enablement Package are the following "Improvements and Fixes"

  • Improves the installation experience when updating to Windows 10, version 1903.
  • Updates to improve security when using Internet Explorer and Microsoft Edge.
  • Updates to improve security when using Microsoft Office products.
  • Updates to improve security when using input devices such as a mouse, keyboard, or stylus.

Security Patch List

Microsoft released the entire list, to expand the list and see every security patch and the severity