Multi critical vulnerabilities on Microsoft products

On February 11, 2019, Microsoft released the February security update. In February, Microsoft fixed up to 99 vulnerabilities, covering Windows operating system, IE / Edge browser, ChakraCore, SQL Server, Exchange Server, office and office services and network applications, Azure DevOps Server, Team Foundation Server, and Microsoft Malware Protection Engine. There are 12 high-risk vulnerabilities and 87 medium-risk vulnerabilities.

Microsoft reports that five of these vulnerabilities have been released with details, one of which has been exploited in the wild. CVE-2020-0674 is the most noteworthy scripting engine vulnerability that can affect IE and Office components. The vulnerability information has been made public, and it is exploited in the wild.

Below we will introduce some critical vulnerabilities:

CVE-2020-0674 – Scripting Engine Memory Corruption Vulnerability

It is a vulnerability of the scripting engine in the Windows operating system and has been used in field attacks. Successful attacks can lead to remote code execution and full user control.

If a user uses IE to browse a specially crafted website, an attacker can execute code on the affected system and gain control. Even if you do not use IE, using Office to open specially crafted documents may still be affected by this vulnerability.

CVE-2020-0729 – LNK Remote Code Execution Vulnerability

It is still a vulnerability caused by (.LNK) files. An attacker can use specially crafted .LNK file to execute arbitrary code. Successful attackers can obtain complete user control.

CVE-2020-0688 – Exchange Memory Corruption Vulnerability

Attackers could send specially crafted emails to execute arbitrary code on the affected Exchange servers. The attack process does not require user interaction, and the attack can obtain complete Exchange server control permissions.