Microsoft has pushed out emergency out-of-band patches for two remote code execution flaws only days after its latest wave of Patch Tuesday bug fixes.
Both the Windows Codecs Library and Visual Studio Code can be targeted by hackers who can exploit these vulnerabilities to execute arbitrary code remotely and potentially take control of the affected system.
The first vulnerability, tagged CVE-2020-17022, is a flaw that exists in the way the Windows Codecs Library handles objects in memory. Successful exploitation requires a programme processes a specially crafted malicious image file.
The second, meanwhile, tagged CVE-2020-17033, is triggered when a user is tricked into opening a malicious ‘package.json’ file. An attacker would need to convince a target to clone a repository and open it in Visual Studio Code, before attacker-specified code would execute when the target opens the malicious ‘package.json’ file.
Attackers can successfully exploit this bug to take control of targeted systems if users with administrative rights are logged on. From there, an unauthorised user could install programmes, view, change or delete data, or even create new accounts with full user rights.
Both patches have been released less than a week after Microsoft rolled out its routine Patch Tuesday wave of updates, in which patches and fixes are accumulated and pushed out in a single release.
The most serious of the bugs fixed was a critical ‘wormable’ flaw in the TCP/IP component of Windows 10, tagged CVE-2020-16898 and rated 9.8 on the CVSS scale, also a remote code execution vulnerability in nature.
RELATED RESOURCE
DevOps without measurement is a fail
How to measure and track the five critical drivers of DevOps success
The two additional bug fixes means these remote code execution flaws are certainly serious enough, and pose enough of an active threat to users, to warrant an out-of-band release.
The firm has previously released emergency fixes for newly detected flaws when deemed necessary, including in July 2020 when it released emergency fixes for another two remote code execution flaws. These issues affected codecs in Windows 10 and Windows Server 2019, and would have allowed hackers to compromise a targeted system.
-
Licensed mmWave: Opportunity or overhead?Industry Insights Ofcom’s latest mmWave auction unlocks major new capacity for 5G and FWA, offering a faster, more flexible complement to fiber - especially in dense urban areas
-
CISA issues alert as China-linked hackers exploit Brickstorm malware to target VMware serversNews Organizations, particularly in the critical infrastructure, government services, and facilities and IT sectors, need to be wary of Brickstorm
-
Security experts claim the CVE Program isn’t up to scratch anymore — inaccurate scores and lengthy delays mean the system needs updatedNews CVE data is vital in combating emerging threats, yet inaccurate ratings and lengthy wait times are placing enterprises at risk
-
IBM AIX users urged to patch immediately as researchers sound alarm on critical flawsNews Network administrators should patch the four IBM AIX flaws as soon as possible
-
Critical Dell Storage Manager flaws could let hackers access sensitive data – patch nowNews A trio of flaws in Dell Storage Manager has prompted a customer alert
-
Flaw in Lenovo’s customer service AI chatbot could let hackers run malicious code, breach networksNews Hackers abusing the Lenovo flaw could inject malicious code with just a single prompt
-
Industry welcomes the NCSC’s new Vulnerability Research Initiative – but does it go far enough?News The cybersecurity agency will work with external researchers to uncover potential security holes in hardware and software
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
