<\/p>\n
<\/p>\n
Microsoft’s May 2020 Security Patch Fixes 111 Bugs<\/span><\/strong><\/span><\/p>\n Before installing this update, please read this article.<\/span><\/strong><\/span><\/a><\/p>\n Who would have guessed that Windows 10 computers had 111 security vulnerabilities and bugs that needed to be fixed?\u00a0 I don’t ever recall a security patch that addressed (fixed?) so many problems at the same time.\u00a0<\/span><\/p>\n But Microsoft’s Windows 10 May 2020 patch attempts to address all 111 bugs all at once. Let’s see how that goes.<\/span><\/p>\n On a positive note, there were no known exploitations of the vulnerabilities – lucky for us that Microsoft discovered them before the hacking crowd did.<\/span><\/p>\n If you want to know more about the technical side of the May 2020 security patch, here is some information from Threatpost…<\/span><\/p>\n Along with the expected cache of operating system, browser, Office and SharePoint updates, Microsoft has also released updates for .NET Framework, .NET Core, Visual Studio, Power BI, Windows Defender, and Microsoft Dynamics.<\/span><\/p>\n The majority of the fixes are important-rated elevation-of-privilege (EoP) bugs. There are a total of 56 of these types of fixes in Microsoft\u2019s May release, primarily impacting various Windows components. This class of vulnerabilities is used by attackers once they\u2019ve managed to gain initial access to a system, in order to execute code on their target systems with elevated privileges.<\/span><\/p>\n Three of these bugs have received a rating of ‘Exploitation More Likely,’ pointed out Satnam Narang, staff research engineer at Tenable: A pair of flaws in Win32k (CVE-2020-1054<\/a>,\u00a0CVE-2020-1143<\/a>) and one in the Windows Graphics Component (CVE-2020-1135<\/a>).<\/span><\/p>\n The two flaws in Win32k both exist when the Windows kernel-mode driver fails to properly handle objects in memory, according to Microsoft\u2019s advisory. An attacker who successfully exploited either vulnerability could run arbitrary code in kernel mode; thus, an attacker could then install programs; view, change or delete data; or create new accounts with full user rights.<\/span><\/p>\n To exploit these, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.<\/span><\/p>\n The Windows Graphics Component EoP bug meanwhile is found in most Windows 10 and Windows Server builds, Jay Goodman, strategic product marketing manager at Automox, told Threatpost. ‘The vulnerability could allow an exploit that leverages how Windows Graphics handles objects in memory,’ he said. ‘An attacker could use this vulnerability to elevate a process\u2019 privileges, allowing the attacker to steal credentials or sensitive data, download additional malware, or execute malicious code.’<\/span><\/p>\n It was demonstrated at this year\u2019s Pwn2Own, said Dustin Childs, researcher at Trend Micro\u2019s Zero-Day Initiative.<\/span><\/p>\n ‘While Pwn2Own may have been virtual<\/a> this year, the bugs demonstrated certainly were not,’ he said in a Patch Tuesday analysis<\/a>. ‘This bug from the Fluoroacetate duo of Richard Zhu and Amat Cama allows a logged-on user to take over a system by running a specially crafted program. They leveraged a use-after-free (UAF) bug in Windows to escalate from a regular user to SYSTEM…’ <\/span><\/p>\n Read more here.<\/a><\/span><\/p><\/blockquote>\n So there you go – now you know. If you see an update notification in the notification area of your Windows 10 PC or tablet, you might want to update your Windows 10 computer as soon as possible.<\/span><\/p>\n <\/p>\n <\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" Microsoft’s May 2020 Security Patch Fixes 111 Bugs Before installing this update, please read this article. Who would have guessed that Windows 10 computers had 111 security vulnerabilities and bugs that needed to be fixed?\u00a0 I don’t ever recall a security patch that addressed (fixed?) so many problems at the same time.\u00a0 But Microsoft’s Windows 10\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":13950,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10,2366],"tags":[3921,3922,3923],"_links":{"self":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/19347"}],"collection":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/comments?post=19347"}],"version-history":[{"count":3,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/19347\/revisions"}],"predecessor-version":[{"id":19384,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/19347\/revisions\/19384"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/media\/13950"}],"wp:attachment":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/media?parent=19347"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/categories?post=19347"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/tags?post=19347"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Privilege-Escalation Bugs to the Fore<\/strong><\/span><\/h2>\n