Patching in Review – Week 3 of 2020

What ever happened to the boring first Patch Tuesday of the year? Between the notorious CryptoAPI spoofing vulnerability and Oracle’s quarterly release, there is almost too much to cover! Without further ado, let’s get into this very dense week.

As always, here are the quick links to stay up to date on any developing known issues:

• Windows 10 / Server 2019 / Server 2016
• Windows 8.1 / Server 2012 R2
• Server 2012
• Windows 7 / Server 2008 R2
• Server 2008

To play a bit of catch up, I’m coming in with the whole month of January. Please see the other articles below to get prepared for February’s patch week!

• Week 1
• Week 2
• Week 4
• Week 5

Patch Tuesday Follow-up

As mentioned earlier, January is usually a very mundane Patch Tuesday. With a traditionally small patch count and short vulnerability list, no one was expecting the NSA disclosure to come out the day before.

Microsoft has since released patches for this alarming vulnerability, but security researchers have continued diving into the vulnerability with new developments. BleepingComputer has 2 great articles covering the CryptoAPI vulnerability for the week.

• Proof of concepts have already come out 2 days after the respective patches were released where the researcher spoofed the github certificate on a compromised system.
• As a refresher, an additional article was written explaining the chain of trust that is compromised in this attack.

Finally, we were all surprised this week to see an addition to the Windows 7 Monthly Rollup, which now will show unwanted upgrade alerts. Fortunately, there is a simple registry key to disable the nuisance.

Security Releases

Outside of Microsoft, there are more 3^rd party security patches than it’s even possible to talk about. Let’s cover this with h a quick rapid-fire summary:

• The January 2020 CPU (Critical Patch Update) released on the same day as Patch Tuesday. For our patching content, this includes security fixes for Java 8 and 11, VirtualBox 5 and 6, as well as the related OpenJDK solutions such as Amazon Corretto.
• VMware Tools 11.0.5 released with CVE-2020-3941 under VMSA-2020-0002.
• Google Chrome released version 79.0.3945.130 with a rare critical vulnerability under CVE-2020-6378.
• Foxit released version 9.7.1 for Reader and PhantomPDF with numerous CVEs.

It’s safe to say this will be a very substantial patching cycle for everyone! Make sure to include the patches above in your weekend push.

Third-Party Updates

Aside from the dizzying amount of security updates, there was an equally large amount of non-securities for the week. See the list below to include in this 3^rd-party-heavy patch week.