Microsoft fixes critical Outlook bug exploitable via preview pane

Microsoft has released the October 2020 Office security updates with a total of 24 security updates and 5 cumulative updates for 7 different products, fixing 13 vulnerabilities that could enable remote attackers to execute arbitrary code on vulnerable systems.

The highlight of this month’s Microsoft Office security updates is without a doubt CVE-2020-16947, a remote code execution vulnerability that leads to remote code execution when previewing or opening maliciously crafted emails with a vulnerable Microsoft Outlook version.

Exploitation can also be achieved in a web-based attack scenario via sites used to host specially crafted files designed to exploit CVE-2020-16947.

When successfully exploited, the bug allows attackers to run arbitrary code in the context of the System user. The attackers could also take over the targeted system if the currently logged on user has administrative user rights.

CVE-2020-16947 affects several Office products including Microsoft Outlook 2016 and Microsoft Office 2019, as well as Microsoft 365 Apps for Enterprise.

List of Office security issues fixed this month

The October 2020 Patch Tuesday Office security updates address remote code execution (RCE), security bypass, elevation of privilege, denial of service, information disclosure, and cross-site scripting vulnerabilities on Windows systems running vulnerable Microsoft Installer (.msi) and Click to Run editions of Microsoft Office products.

Microsoft rated the 11 RCE security flaws patched this month Critical or Important severity issues seeing that they could enable attackers to execute arbitrary code in the context of the current user after successful exploitation.

The attackers could then install malicious programs, view, change, and delete data, as well as create their own rogue admin accounts on compromised Windows devices.

Tag CVE ID Title Severity Microsoft Office CVE-2020-16933 Microsoft Word Security Feature Bypass Vulnerability Important Microsoft Office CVE-2020-16929 Microsoft Excel Remote Code Execution Vulnerability Important Microsoft Office CVE-2020-16934 Microsoft Office Click-to-Run Elevation of Privilege Vulnerability Important Microsoft Office CVE-2020-16932 Microsoft Excel Remote Code Execution Vulnerability Important Microsoft Office CVE-2020-16930 Microsoft Excel Remote Code Execution Vulnerability Important Microsoft Office CVE-2020-16955 Microsoft Office Click-to-Run Elevation of Privilege Vulnerability Important Microsoft Office CVE-2020-16928 Microsoft Office Click-to-Run Elevation of Privilege Vulnerability Important Microsoft Office CVE-2020-16957 Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability Important Microsoft Office CVE-2020-16918 Base3D Remote Code Execution Vulnerability Important Microsoft Office CVE-2020-16949 Microsoft Outlook Denial of Service Vulnerability Moderate Microsoft Office CVE-2020-16947 Microsoft Outlook Remote Code Execution Vulnerability Critical Microsoft Office CVE-2020-16931 Microsoft Excel Remote Code Execution Vulnerability Important Microsoft Office CVE-2020-16954 Microsoft Office Remote Code Execution Vulnerability Important Microsoft Office CVE-2020-17003 Base3D Remote Code Execution Vulnerability Critical Microsoft Office SharePoint CVE-2020-16948 Microsoft SharePoint Information Disclosure Vulnerability Important Microsoft Office SharePoint CVE-2020-16953 Microsoft SharePoint Information Disclosure Vulnerability Important Microsoft Office SharePoint CVE-2020-16942 Microsoft SharePoint Information Disclosure Vulnerability Important Microsoft Office SharePoint CVE-2020-16951 Microsoft SharePoint Remote Code Execution Vulnerability Critical Microsoft Office SharePoint CVE-2020-16944 Microsoft SharePoint Reflective XSS Vulnerability Important Microsoft Office SharePoint CVE-2020-16945 Microsoft Office SharePoint XSS Vulnerability Important Microsoft Office SharePoint CVE-2020-16946 Microsoft Office SharePoint XSS Vulnerability Important Microsoft Office SharePoint CVE-2020-16941 Microsoft SharePoint Information Disclosure Vulnerability Important Microsoft Office SharePoint CVE-2020-16950 Microsoft SharePoint Information Disclosure Vulnerability Important Microsoft Office SharePoint CVE-2020-16952 Microsoft SharePoint Remote Code Execution Vulnerability Critical

October 2020 Microsoft Office security updates

This month’s Microsoft Office security updates are delivered via the Microsoft Update platform and through the Download Center.

To download October 2020 Microsoft Office security updates, click on their corresponding knowledge base article below and then scroll down to the ‘How to download and install the update’ section to grab the updates for your Office product.

More information including CVE IDs is available within the knowledge base articles linked below.

Microsoft Office 2016

Microsoft Office 2013

Microsoft Office 2010

Microsoft SharePoint Server 2019

Microsoft SharePoint Server 2016

Product Knowledge Base article SharePoint Enterprise Server 2016 Security update for SharePoint Enterprise Server 2016 (KB4486677)

Microsoft SharePoint Server 2013

Microsoft SharePoint Server 2010

October 2020 Patch Tuesday security updates

Yesterday, Redmond also released the October 2020 Patch Tuesday security updates with security updates for 87 vulnerabilities, 12 of them being rated as Critical, 74 as Important, and one as moderate.

Non-security Windows updates with fixes and improvements were also issued yesterday with the Windows 10 KB4579311 & KB4577671 Cumulative Updates.

As part of this month’s Patch Tuesday, Microsoft also addressed a critical vulnerability in the Windows TCP/IP stack tracked as CVE-2020-16898 and dubbed ‘Bad Neighbor’.

US Cyber Command warned Microsoft customers to immediately patch the Bad Neighbor bug known to affect multiple client (Windows 10) and server (Windows Server) platforms.

Source

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s