Advisory Date: 12 de lutego de 2020

  DESCRIPTION

Microsoft addresses several vulnerabilities in its February security bulletin. Trend Micro Deep Security covers the following:

  • CVE-2020-0674 - Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the scripting engine of Internet explorer in the way it handles objects in memory. Attackers looking to exploit this vulnerability could host a specially crafted website that contains an exploit.


  • CVE-2020-0681 - Remote Desktop Client Remote Code Execution Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the Windows Remote Desktop Client. It exists when a user connects to a malicious server. Attackers looking to exploit this vulnerability could find ways to convince a user of a vulnerable machine to connect to a malicious server.


  • CVE-2020-0692 - Microsoft Exchange Server Elevation of Privilege Vulnerability
    Risk Rating: Important

    This elevation of privilege vulnerability, that requires an enabled Exchange Web Services (EWS), exists in the Microsoft Exchange Server. Attackers looking to exploit this vulnerability must find a way to change Security Access Token parameters and forward that to the vulnerable Microsoft Exchange Server.


  INFORMATION EXPOSURE

Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using the Vulnerability Protection are also protected from attacks using these vulnerabilities.

Vulnerability ID DPI Rule Number DPI Rule Name Release Date Vulnerability Protection Compatibility
CVE-2020-0674 1010133 Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2020-0674) 11-Feb-20 YES
CVE-2020-0681 1010150 Microsoft Windows Remote Desktop Client Remote Code Execution Vulnerability (CVE-2020-0681) 11-Feb-20 YES
CVE-2020-0692 1010151 Identified Usage Of 'X-JsonProxySecurityContext' HTTP Header 11-Feb-20 YES