Tenable Advises Enterprises to Patch RCE Windows Codecs

By VARINDIA - 2020-10-20

Tenable Advises Enterprises to Patch RCE Windows Codecs

The US' CISA issued an advisory for two Microsoft vulnerabilities not addressed in last week's Patch Tuesday update.

 

Rody Quinlan, Security Response Manager at Tenable has offered the following perspective:

 

"On Friday, October 16, the Cybersecurity & Infrastructure Security Agency (CISA) released an advisory in response to Microsoft's out-of-band patches for CVE-2020-17022 and CVE-2020-17023, both with a CVSS of 7.8 and highlighted as "important" by Microsoft. The former is a remote code execution (RCE) vulnerability in the Microsoft Windows Codecs Library given how it handles objects in memory, specifically versions prior to 1.0.32762.0 or 1.0.32763.0 of the High-Efficiency Video Coding (HVEC) video codecs. The latter is an RCE vulnerability in Visual Studio Code that can be triggered by the opening of a malicious "package.json" file. This vulnerability stems from an unsuccessful patch for CVE-2020-16881 released as part of Microsoft's regular Patch Tuesday updates in September.

 

While these are RCEs, both require a degree of social engineering to exploit. In the case of CVE-2020-17022, a threat actor would need to convince a victim to use a program to process a maliciously crafted image file. For CVE-2020-17023, a threat actor must convince a victim to clone a repository, with a malicious "package.json" and open it in Visual Studio Code. Exploitation of either vulnerability results in the execution of arbitrary code on the target system.

 

Microsoft does not commonly release out-of-band patches. However, in the case of CVE-2020-17022, Microsoft notes that, "These updates are for optional apps/components that are offered to customers as a download via the Microsoft Store," hence the OOB patching approach. Microsoft also notes for CVE-2020-17022 that, "Affected customers will be automatically updated by Microsoft Store." With CVE-2020-17023 requiring an update to be applied, coupled with an out-of-band advisory, we encourage administrators to patch quickly, despite this vulnerability requiring some level of user-interaction to exploit. While Microsoft highlights there has been no exploitation observed in the wild the follow up of the CISA advisory suggests that administrators should review the patches and apply the updates if necessary."


 CIO  - SPEAK
Start-Up and Unicorn Ecosystem
 SOFTWARE  Placeholder image
IBM along with ANSR to establish and operate Centers of Excellence

IBM along with ANSR to establish and operate Centers of Excellence

IBM and ANSR have announced a strategic collaboration to set up and manage Centers of Exce...

ANSR collaborates with IBM to establish and operate Centers of Excellence in advanced enterprise technologies

ANSR collaborates with IBM to establish and operate Centers of Excellence in advanced enterprise technologies

India : IBM (NYSE: IBM) and ANSR Consulting Inc., the global market leader...

Stratbeans rolls out cloud-based assessment platform for BFSI sector

Stratbeans rolls out cloud-based assessment platform for BFSI sector

Stratbeans has developed a cloud-based assessment platform for the banking, financial serv...

VARINDIA SIITF
SOUTHERN INDIA INFORMATION TECHNOLOGY FAIR (SIITF) -2018
BANGALURU
VARIndia - Star Nite Awards
STAR NITE AWARDS(SNA) - 2018
NEW DELHI
VARINDIA - OITF
ODISHA INFORMATION TECHNOLOGY FAIR(OITF)-2019
BHUBANESWAR
VARINDIA - WIITF
WESTERN INDIA INFORMATION TECHNOLOGY FAIR(WIITF) - 2019
MUMBAI
 INDUSTRY EVENTS Placeholder image
SecOps, DevOps and CloudOps need to work in tandem to achieve cyber resilience

SecOps, DevOps and CloudOps need to work in tandem to achieve cyber resilience

CLOUDSEC 2020, one of the industry's biggest cybersecurity events hosted by Trend Micr...

The Digital Ecosystem Needs a  Legal Framework for Governance  Union Law Minister, Shri Ravi Shankar Prasad

The Digital Ecosystem Needs a Legal Framework for Governance Union Law Minister, Shri Ravi Shankar Prasad

“Technology is going to be play a very crucial role in the future of Law Education a...


Copyright varindia.com @1999-2020 - All rights reserved.
Reproduction in whole or in part in any form or medium without express written permission of Kalinga Digital Media Pvt. Ltd. is prohibited.
Other Initiatives : www.mybrandbook.co.in | www.spoindia.org

advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription advertisement video production, home video distributors, home video company, List of PC Magazines, Best online PC Magazines, Top Online PC Magazines in India, Best online PC Magazines in India, Best PC Magazine, PC Magazine Subscription