Microsoft fixes 'critical' wormable RCE flaw in Windows 10

The latest Patch Tuesday release sees 87 bugs fixed including the CVSS 9.8-rated vulnerability

Person types on laptop in the dark

Microsoft has patched a highly severe vulnerability in the Windows operating system TCP/IP stack, which could have allowed an attacker to execute code on a target server remotely. 

The remote code execution vulnerability, which is wormable, has been fixed as part of a fresh wave of 87 patches as part of the firm’s routine fortnightly Patch Tuesday bug fixes, and is one of 11 critical flaws seen to.

McAfee, which first discovered the wormable vulnerability, has dubbed it ‘bad neighbor’ and branded the proof-of-concept as “both extremely simple and perfectly reliable”. 

Before it was patched, hackers could have exploited the flaw, assigned CVE-2020-16898 and rated 9.8 on the CVSS severity scale, due to the way that the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. This affected users with machines running Windows 10 and Windows Server 2019. 

Doing so would grant the attacker the ability to execute remote code on the targeted client by sending specially crafted ICMPv6 Router Advertisement packets to a remote Windows machine. The update, released yesterday, addresses how the Windows TCP/IP stack handles these packets.

Another notable vulnerability, tagged CVE-2020-16891, is a remote code execution exploit in Windows Hyper-V. This would have allowed an attacker to run a specially crafted programme on an affected guest operating system to execute arbitrary code on the host operating system. 

The full round of fixes applies to bugs found in Windows, Microsoft Office, Azure Functions, Microsoft Exchange Server, Visual Studio, Adobe Flash player, and many other services. Of these 87 bugs, 11 have been deemed critical, while 74 are classed as important, and a further one is categorised as being moderate in severity. There’s no evidence to suggest any of these flaws have been publicly exploited.

Although there are still a handful of serious security threats that Microsoft has addressed, the routine Patch Tuesday round of fixes actually comprises fewer vulnerabilities than businesses have come to expect in recent months. SolarWinds MSP’s head security nerd Gill Langston also claims that this October Patch Tuesday is the first batch that fixes fewer than 100 vulnerabilities

“Don’t be fooled by that, as there are several in this group that do warrant your attention,” he said.

"Pay special attention to the 'Important' ones, as many of them are listed as “Exploitation More Likely” and will be in the priority list. While there are no active attacks according to Microsoft, there is a high likelihood some may appear soon for several of these. While this month’s batch was lighter than usual, there are some real attention getters here.”

Langston has recommended that businesses address the TCP/IP flaw first and foremost, before shifting their attention to getting RDP servers patched, since remote desktop seems to be one of the current most popular attack vectors.

Next, IT admins should focus on patching Hyper-V systems, and then patching workstations, especially those running Outlook, before finally addressing SharePoint servers.

Featured Resources

Unlocking collaboration: Making software work better together

How to improve collaboration and agility with the right tech

Download now

Four steps to field service excellence

How to thrive in the experience economy

Download now

Six things a developer should know about Postgres

Why enterprises are choosing PostgreSQL

Download now

The path to CX excellence for B2B services

The four stages to thrive in the experience economy

Download now

Recommended

Russia launched over a million cyber attacks in three months
hacking

Russia launched over a million cyber attacks in three months

13 Apr 2021
New DNS vulnerabilities put millions of IoT devices at risk
Internet of Things (IoT)

New DNS vulnerabilities put millions of IoT devices at risk

13 Apr 2021
Cloud storage: How secure are Dropbox, OneDrive, Google Drive, and iCloud?
cloud security

Cloud storage: How secure are Dropbox, OneDrive, Google Drive, and iCloud?

13 Apr 2021
5G will accelerate cyber crime, predicts former White House CIO
5G

5G will accelerate cyber crime, predicts former White House CIO

13 Apr 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021
Hackers are using fake messages to break into WhatsApp accounts
instant messaging (IM)

Hackers are using fake messages to break into WhatsApp accounts

8 Apr 2021